CVE-2026-32326

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector : AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability : 2.1 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://global.sharp/corporate/info/product-security/advisory-list/2026-002/
https://jvn.jp/en/jp/JVN49524110/

Configurations

No configuration.

History

17 Jun 2026, 10:35

Type	Values Removed	Values Added
Summary		(es) Los routers SHARP no realizan autenticación para algunas API web. La información del dispositivo puede ser recuperada sin autenticación. Si la contraseña administrativa del dispositivo se deja como la inicial, el dispositivo puede ser tomado.

25 Mar 2026, 08:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-25 08:16

Updated : 2026-06-17 10:35

NVD link : CVE-2026-32326

Mitre link : CVE-2026-32326

CVE.ORG link : CVE-2026-32326

JSON object : View

Products Affected

No product.

CWE

CWE-306

Missing Authentication for Critical Function

{"id": "CVE-2026-32326", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32326", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:26:41.257984Z"}}], "cvssMetricV30": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.7, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}], "cvssMetricV40": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "vultures@jpcert.or.jp", "affectedData": [{"vendor": "Sharp Corporation", "product": "home 5G HR01", "versions": [{"status": "affected", "version": "38JP_0_490 and earlier"}]}, {"vendor": "Sharp Corporation", "product": "home 5G HR02", "versions": [{"status": "affected", "version": "S5.A1.00 and earlier"}]}, {"vendor": "Sharp Corporation", "product": "Wi-Fi STATION SH-52A", "versions": [{"status": "affected", "version": "38JP_2_03J and earlier"}]}, {"vendor": "Sharp Corporation", "product": "Wi-Fi STATION SH-52B", "versions": [{"status": "affected", "version": "S3.87.15 and earlierr"}]}, {"vendor": "Sharp Corporation", "product": "Wi-Fi STATION SH-54C", "versions": [{"status": "affected", "version": "S6.64.00 and earlier"}]}, {"vendor": "Sharp Corporation", "product": "5G Mobile Router SH-U01", "versions": [{"status": "affected", "version": "S4.48.00 and earlier"}]}, {"vendor": "Sharp Corporation", "product": "Pocket WiFi 5G A503SH", "versions": [{"status": "affected", "version": "S7.41.00 and earlier"}]}, {"vendor": "Sharp Corporation", "product": "Speed Wi-Fi 5G X01", "versions": [{"status": "affected", "version": "3RJP_2_03I and earlier"}]}]}], "published": "2026-03-25T08:16:22.547", "references": [{"url": "https://global.sharp/corporate/info/product-security/advisory-list/2026-002/", "source": "vultures@jpcert.or.jp"}, {"url": "https://jvn.jp/en/jp/JVN49524110/", "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over."}, {"lang": "es", "value": "Los routers SHARP no realizan autenticaci\u00f3n para algunas API web. La informaci\u00f3n del dispositivo puede ser recuperada sin autenticaci\u00f3n. Si la contrase\u00f1a administrativa del dispositivo se deja como la inicial, el dispositivo puede ser tomado."}], "lastModified": "2026-06-17T10:35:34.167", "sourceIdentifier": "vultures@jpcert.or.jp"}