CVE-2026-78249
Received Received - Intake

Path Traversal in Multifunction Printer Web Interface

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: 47e4fddc-a2f1-48a0-beab-943c84c1c954

Description
A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a specially crafted, malicious request, it may trigger unintended processing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-78249
EUVD
EUVD-2026-90549

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
fujifilm apeos_c4571 1.1.3
fujifilm apeos_c3567 1.1.3
sharp bp-1360m 25.11.27
sharp bp-1250m 25.11.27
sharp bp-1360m 1.0.3
sharp bp-1250m 1.0.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-78249 is a path traversal vulnerability in the web management interface of certain multifunction devices and printers. It allows unauthorized access to stored information on the device by exploiting improper handling of externally supplied parameters in a malicious request.

Detection Guidance

Detecting this path traversal vulnerability requires checking firmware versions and monitoring network traffic for suspicious requests. For Fujifilm devices, verify if the firmware is version 1.1.3 or earlier. For Sharp devices, check if the system version is 25.11.27 or earlier and controller version is 1.0.3 or earlier. Use device settings to confirm versions. Monitor web management interface logs for unusual parameter patterns or unauthorized access attempts.

Impact Analysis

This vulnerability could allow attackers with network access and administrator privileges to access restricted information on the device. It may lead to data breaches or unauthorized disclosure of sensitive data stored on the device.

Compliance Impact

This vulnerability could lead to unauthorized access to stored information on affected devices, which may include sensitive data such as personal or health records. Such access could violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy) if exploited.

Mitigation Strategies
  • Update firmware to the fixed versions provided by Fujifilm and Sharp for affected models.
  • Operate devices behind a properly configured firewall to restrict access.
  • Change default administrator passwords to strong, unique credentials.
  • Restrict access to administrative functions to essential personnel only.
  • Avoid direct internet connections for these devices.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart