{"id":"CVE-2026-32326","aliases":["EUVD-2026-15194","GHSA-wg6h-5fm8-5gmj"],"status":"published","title":"SHARP routers do not perform authentication for some web APIs. The device information may be...","description":"SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00352,"percentile":0.29139,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306"],"published":"2026-03-25T07:38:20Z","modified":"2026-06-17T10:35:34Z","products":[{"vendor":"sharp corporation","product":"5g mobile router sh-u01"},{"vendor":"sharp corporation","product":"home 5g hr01"},{"vendor":"sharp corporation","product":"home 5g hr02"},{"vendor":"sharp corporation","product":"pocket wifi 5g a503sh"},{"vendor":"sharp corporation","product":"speed wi-fi 5g x01"},{"vendor":"sharp corporation","product":"wi-fi station sh-52a"},{"vendor":"sharp corporation","product":"wi-fi station sh-52b"},{"vendor":"sharp corporation","product":"wi-fi station sh-54c"}],"references":[{"url":"https://global.sharp/corporate/info/product-security/advisory-list/2026-002/"},{"url":"https://jvn.jp/en/jp/JVN49524110/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32326"},{"url":"https://global.sharp/corporate/info/product-security/advisory-list/2026-002"},{"url":"https://jvn.jp/en/jp/JVN49524110"},{"url":"https://github.com/advisories/GHSA-wg6h-5fm8-5gmj"}],"sources":{"cve":[{"id":"CVE-2026-32326","description":"SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.","status":"published","published":"2026-03-25T07:38:20.672Z","modified":"2026-03-25T13:26:49.064Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:19:57.47301Z"}],"euvd":[{"id":"EUVD-2026-15194","description":"SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.","status":"published","published":"2026-03-25T07:38:20Z","modified":"2026-03-25T13:26:49Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:29.547775Z"}],"ghsa":[{"id":"GHSA-wg6h-5fm8-5gmj","title":"SHARP routers do not perform authentication for some web APIs. The device information may be...","description":"SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.","status":"published","published":"2026-03-25T09:31:36Z","modified":"2026-03-25T09:31:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:06:50.631069Z"}],"nvd":[{"id":"CVE-2026-32326","description":"SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.","status":"published","published":"2026-03-25T08:16:22.547Z","modified":"2026-06-17T10:35:34.167Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.7,"vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:12:11.077116Z"}]}}