Sharp and Toshiba Copier Flaws: Turn On User Authentication

On Friday, July 31, Sharp and Toshiba Tec each published security advisories for their office multifunction printers (MFPs), coordinated through JPCERT/CC and published on Japan Vulnerability Notes (JVN) as JVNVU#98759887, "Multiple vulnerabilities in Sharp and Toshiba Tec MFPs," according to JVN, Sharp and Toshiba Tec. On Monday, August 3, the U.S. National Vulnerability Database published the three CVEs.

Two of the three flaws are fixed by updated firmware, which on leased or dealer-serviced copiers is usually installed by the dealer. The third is different: it's a factory default, and it's the one worth checking this week. Affected Sharp and Toshiba Tec models built for markets outside Japan, which includes the US, shipped with user authentication turned off.

What did Sharp and Toshiba Tec disclose?

Three vulnerabilities in their MFPs: one lets someone on the network pull stored images without logging in, one leaves print data cached on the machine, and one is an insecure default setting. Here's the summary from JVN, NVD and the vendors' advisories.

CVE-2026-60011 is an authentication bypass. The machines fail to properly authorize requests that directly access certain stored image data, so someone who tampers with requests to the MFP's web interface can retrieve that data without logging in, according to NVD, JVN and SentinelOne's vulnerability database. NVD shows JPCERT/CC's rating: Medium, 6.9 under CVSS v4.0.

CVE-2026-63545 is lower risk. The machines cache data internally when printing and don't clear it, so other users can later get at it, but it's rated Low (2.4) and requires physical access to the device, per JVN, OpenCVE and INCIBE-CERT.

Why does the authentication default matter most?

Because it's the flaw you can fix yourself today, and the vendors' remedy for it is a settings change, not a firmware update. Under CVE-2026-63563, affected products for markets outside Japan shipped with the user authentication feature disabled, so address book editing and a range of Document Filing (stored-document) features can be used without signing in, according to JVN, Toshiba Tec and SentinelOne. Products made for the Japanese market aren't affected. It's rated Medium, 6.9 under CVSS v4.0 (JPCERT/CC's score, the same as the authentication bypass), according to NVD, OpenCVE and SentinelOne.

The vendors' workaround is to turn user authentication on, which puts the job in your hands, or your dealer's.

In practical terms, anyone who can reach the machine over your office network could use those features without identifying themselves. The address book is the easiest to picture. For example, if someone changed a scan-to-email entry, scans meant for your bookkeeper could quietly go somewhere else.

Is my office's machine affected?

If you have a Sharp or Toshiba Tec MFP built for the US market, the authentication default is the first thing to check. Whether your specific model is on the affected lists, and whether it needs the firmware fixes, depends on the model and its firmware version. The vendors publish those details, so check Sharp's advisory and Toshiba Tec's notice for your model rather than relying on a summary. If the machine is leased or under a service contract, your dealer can tell you the model and current firmware version.

How do you check that user authentication is turned on?

Start with a one-minute test at the machine: walk up and try to open the address book or Document Filing without signing in. If the machine never asks you to sign in or enter a user code, authentication is very likely off.

Menu names vary by model, so we won't guess at them. In general, an administrator signs in to the MFP's web page (type the printer's IP address into a browser on an office PC) or to the administrator settings on the control panel, finds the user control or authentication settings, turns on user authentication, and sets up staff accounts or codes. Because this changes how everyone uses the machine, set up the accounts first, then switch it on, then test printing, copying and scanning from a couple of desks. If your dealer manages the machine, ask them to do it.

While you're in the settings, three general best practices (ours, not quotes from the advisories), which our list of printer security features covers in more depth:

• Change the default administrator password and require a password for the machine's web page.
• Keep the MFP off the public internet, behind your office firewall.
• Delete stored jobs you no longer need from Document Filing, turn on automatic deletion if your model offers it, and don't treat the copier as a filing cabinet.

What about the firmware fixes?

Sharp and Toshiba Tec released updated firmware for CVE-2026-60011 and CVE-2026-63545, according to JVN, Sharp and Toshiba Tec. Toshiba Tec tells customers to ask their service company to update the main-unit software. On most leased or dealer-serviced machines, whatever the brand, your dealer handles firmware, so call them.

Ask three questions: Is our model on the affected list? When will you install the update? Can you confirm the new firmware version in writing? If you're not sure who is responsible for firmware under your agreement, last week's contract checklist shows where to look.

Because CVE-2026-63545 needs physical access, it also helps to keep the MFP where staff can see it, not in an unattended hallway or shared lobby.

What about Sharp's Network Scanner Tool?

Also on July 31, Sharp disclosed CVE-2026-62416 (JVNVU#92540957), a separate flaw in its Network Scanner Tool and Network Scanner Tool Lite, according to Sharp, JVN and NVD. These are Windows apps that act as FTP servers to receive scans from MFPs, and in their initial configuration anyone can upload files to them without authentication. Affected versions include Network Scanner Tool Lite V2.0.13.3 and earlier, plus older versions of the Network Scanner Tool bundled with Sharpdesk.

Sharp's mitigation: turn off "Allow anonymous FTP log-in" and set a custom FTP log-in user name and password. If your office scans to a PC with either tool, do that now and check Sharp's advisory for current versions.

What this means for San Fernando Valley offices

The authentication default isn't a far-off problem. It affects models built for markets outside Japan, which puts affected US-market Sharp and Toshiba Tec MFPs, like those in Valley offices, in scope.

For law, medical, accounting and real estate offices, the concern is what the machine stores: scanned images can include client or patient personal information. California's breach-notification law (Civil Code 1798.82, as amended by SB 446, effective January 1, 2026) requires businesses to notify California residents within 30 calendar days of discovering a breach of their unencrypted personal information. If more than 500 residents are notified, a sample notice must go to the Attorney General within 15 calendar days of notifying consumers, with exceptions for law-enforcement needs and for determining the breach's scope. That's according to the Civil Code, the California Attorney General, Pillsbury and Jackson Lewis.

Whether exposed images on a copier add up to a notifiable breach depends on what they contained, which is a question for your attorney. It's far easier to turn on a setting now than to work through that question later. Medical offices should also read our Sherman Oaks guide to medical office printers and HIPAA, and anyone storing client files should see our guide to secure document printing.

What to do now

1. List every Sharp and Toshiba Tec MFP in the office, with its model name and who services it.
2. Check each model against Sharp's advisory and Toshiba Tec's notice.
3. Confirm user authentication is on; if it isn't, set up staff accounts and turn it on, or have your dealer do it.
4. Change the default administrator password and require a password for the machine's web page.
5. Ask your dealer or service company to install the updated firmware and confirm the new version in writing.
6. Delete stored jobs you don't need from Document Filing and stop using it as long-term storage.
7. If you use Sharp Network Scanner Tool or Network Scanner Tool Lite, turn off anonymous FTP log-in and set a custom user name and password.
8. Decide now who calls your attorney if a device ever exposes client data, so California's 30-day clock doesn't catch you flat-footed.

If you'd like help checking these settings across your machines, book a free virtual consultation. If you'd rather we do the hands-on work, our security hardening service runs $299 to $599.