#VU121022 Path traversal in Sharp Display Solutions products - CVE-2025-11540

Vulnerability identifier: #VU121022

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2025-11540

CWE-ID: CWE-22

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
NP-P502HL-2
NP-P502WL-2
NP-P502HLG-2
NP-P502WLG
NP-P502H
NP-P502W
NP-P452H
NP-P452W
NP-P502HG
NP-P502WG
NP-P452HG
NP-P452WG
NP-P502H+
NP-P502W+
NP-CR5450H
NP-CR5450W
NP-P502HL
NP-P502WL
NP-P502HLG
NP-P502HL+
NP-P502WL+
NP-CR5450HL
NP-CR5450WL
NP-UM352W
NP-UM352WG
NP-UM352W+

Software vendor:
Sharp Display Solutions

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can send a specially crafted HTTP request and read arbitrary files on the system.

Install updates from vendor's website.

• https://jvn.jp/en/jp/JVN45776251/index.html
• https://sharp-displays.jp.sharp/global/support/info/PJ-CVE-2025-11540.html