CVE-2026-63563

MEDIUM

Sharp and Toshiba Tec MFPs Authentication Bypass via Insecure Default Configuration

Generated titleSource: EIP title enrichment
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2026-63563 has a selected CVSS score of 6.9 (medium); EIP currently links 1 repository PoC.

Description

Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication. Products intended for the Japanese market are not affected.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 3, 2026 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Sharp MFPs

Browse Sharp Corporation / Sharp MFPs
CVE Listsee the information provided by Sharp Corporationaffected

Toshiba Tec MFPs

Browse Toshiba Tec Corporation / Toshiba Tec MFPs
CVE Listsee the information provided by Toshiba Tecaffected

Proofs of concept

1

Repository PoCs

GitHubredr0nin/CVE-2026-63563Repository PoCby johnjhacking0Writeup9 files

416.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a technical writeup describing an unauthenticated address book modification vulnerability in Sharp MX/BP multifunction printers. It details how an attacker can view and modify scan destinations (SMB, FTP, Email) without authentication, leading to credential harvesting or silent document exfiltration. The README includes a step-by-step 'Proof of Concept' section, but this section only describes manual actions to be performed by a human operator through the printer's web interface; it does not contain any executable code, scripts, or automated tools to exploit or scan for the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The artifact is a README.md file documenting CVE-2026-63563, a vulnerability in Sharp multifunction printers. The file describes how an unauthenticated attacker can exploit the printer's web interface to harvest credentials or exfiltrate documents. The README itself contains no executable code, no concealed payloads, and no instructions for the reviewer to execute anything. It is a standard vulnerability disclosure document.

ClassificationWriteup
Model confidence98%
AuthenticationNot required
LanguagesEnglish
Target softwareSharp MX/BP series multifunction printers
Attack typesinformation disclosurecredential harvestingdata exfiltration
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a technical analysis of CVE-2026-63563, including a summary, affected models, technical details, and a disclosure timeline. The 'Proof of concept' section (lines 88-95) lists manual steps for a human to follow using a web browser and external tools like Responder. It contains no executable code, scripts, or automated scanning logic. This constitutes a substantive technical analysis without exploit or scanner code, fitting the definition of a writeup.

README.md:88-95

Requirements

  • Network access to the printer's web interface.README.md:7
  • Printer must be in default configuration where password protection for the device web page is not enforced.README.md:14

Observed behavior

  • Discloses internal email addresses, SMB paths, and hostnames by accessing /addressbook.html without authentication.README.md:24
  • Allows modification of the Network Folder path to an attacker-controlled SMB share without requiring the stored password, leading to NTLMv2 hash capture.README.md:48
  • Allows addition of an attacker-controlled email address as a default destination alongside the original, enabling silent document exfiltration.README.md:64
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Description
The README describes CVE-2026-63563, an authentication bypass in Sharp MX/BP printers allowing unauthenticated access to the address book via the web interface, leading to credential harvesting and document exfiltration.This is the stated purpose of the repository and matches the expected behavior of a PoC documentation artifact.README.md:1-103
Url
https://global.sharp/corporate/info/product-security/advisory-list/2026-004/Vendor advisory URL referenced in the disclosure.README.md:3
Review boundaries

What the analysis did not establish

  • The evidence packet contains only the README.md file. The repository includes 7 non-text media files (images) and 1 other text file that were not provided, which may contain additional context.
  • The CVE record for CVE-2026-63563 was absent from the acquired CVEList, so no external CVE description could be correlated.
  • Only the README.md file was provided as text; 7 non-text media files (images) and 1 other text file were omitted from the review packet.
  • The analysis scope is limited to the supplied evidence; no other files in the repository were inspected.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

6