redr0nin/CVE-2026-63563
PoC files
9 filesFile viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.
Analysis
Technical assessment
The artifact is a technical writeup describing an unauthenticated address book modification vulnerability in Sharp MX/BP multifunction printers. It details how an attacker can view and modify scan destinations (SMB, FTP, Email) without authentication, leading to credential harvesting or silent document exfiltration. The README includes a step-by-step 'Proof of Concept' section, but this section only describes manual actions to be performed by a human operator through the printer's web interface; it does not contain any executable code, scripts, or automated tools to exploit or scan for the vulnerability.
Backdoor review
No backdoor observed in reviewed code
The artifact is a README.md file documenting CVE-2026-63563, a vulnerability in Sharp multifunction printers. The file describes how an unauthenticated attacker can exploit the printer's web interface to harvest credentials or exfiltrate documents. The README itself contains no executable code, no concealed payloads, and no instructions for the reviewer to execute anything. It is a standard vulnerability disclosure document.
Classification basis and observed behavior
Classification basis
The artifact is a README.md file that provides a technical analysis of CVE-2026-63563, including a summary, affected models, technical details, and a disclosure timeline. The 'Proof of concept' section (lines 88-95) lists manual steps for a human to follow using a web browser and external tools like Responder. It contains no executable code, scripts, or automated scanning logic. This constitutes a substantive technical analysis without exploit or scanner code, fitting the definition of a writeup.
README.md:88-95Requirements
- Network access to the printer's web interface.
README.md:7 - Printer must be in default configuration where password protection for the device web page is not enforced.
README.md:14
Observed behavior
- Discloses internal email addresses, SMB paths, and hostnames by accessing /addressbook.html without authentication.
README.md:24 - Allows modification of the Network Folder path to an attacker-controlled SMB share without requiring the stored password, leading to NTLMv2 hash capture.
README.md:48 - Allows addition of an attacker-controlled email address as a default destination alongside the original, enabling silent document exfiltration.
README.md:64
Behaviors behind the backdoor verdict
Observables
- Vulnerability Description
- The README describes CVE-2026-63563, an authentication bypass in Sharp MX/BP printers allowing unauthenticated access to the address book via the web interface, leading to credential harvesting and document exfiltration.This is the stated purpose of the repository and matches the expected behavior of a PoC documentation artifact.
README.md:1-103 - Url
- https://global.sharp/corporate/info/product-security/advisory-list/2026-004/Vendor advisory URL referenced in the disclosure.
README.md:3
What the analysis did not establish
- The evidence packet contains only the README.md file. The repository includes 7 non-text media files (images) and 1 other text file that were not provided, which may contain additional context.
- The CVE record for CVE-2026-63563 was absent from the acquired CVEList, so no external CVE description could be correlated.
- Only the README.md file was provided as text; 7 non-text media files (images) and 1 other text file were omitted from the review packet.
- The analysis scope is limited to the supplied evidence; no other files in the repository were inspected.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.