Stack-based buffer overflow in Sharp Corporation NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2…
Priority MEDIUM 45CWE-121Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · Low · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00414 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sharp Corporation | NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502WLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG, NP-UM352W+ | All versions | — | No fix listed | CNA |
- NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502WLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG, NP-UM352W+ VendorSharp Corporation Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 52
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sharp:np-p502h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p452h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p452h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p452w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p452w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
- cpe:2.3:o:sharp:np-p502h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p452h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p452h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p452w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p452w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
Show 42 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:sharp:np-p502wg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502wg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p452hg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p452hg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p452wg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p452wg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502h\+_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502h\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502w\+_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502w\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-cr5450h_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-cr5450h:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-cr5450w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-cr5450w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502wl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502wl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hlg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hlg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502wlg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502wlg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hl\+_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hl\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502wl\+_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502wl\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-cr5450hl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-cr5450hl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-cr5450wl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-cr5450wl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hl-2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hl-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502wl-2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502wl-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-p502hlg-2_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-p502hlg-2:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-um352w_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-um352w:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-um352wg_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-um352wg:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
| cpe:2.3:o:sharp:np-um352w\+_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Sharp Corporation |
| cpe:2.3:h:sharp:np-um352w\+:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Sharp Corporation |
- cpe:2.3:o:sharp:np-p502wg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p452hg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p452hg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p452wg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p452wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502h\+_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502h\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502w\+_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502w\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-cr5450h_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-cr5450h:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-cr5450w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-cr5450w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502wl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502wl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hlg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hlg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502wlg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502wlg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hl\+_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hl\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502wl\+_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502wl\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-cr5450hl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-cr5450hl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-cr5450wl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-cr5450wl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hl-2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hl-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502wl-2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502wl-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-p502hlg-2_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-p502hlg-2:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-um352w_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-um352w:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-um352wg_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-um352wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
- cpe:2.3:o:sharp:np-um352w\+_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Sharp Corporation
- cpe:2.3:h:sharp:np-um352w\+:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Sharp Corporation
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11542
- 2026-10-03 Alias added: GHSA-7xr9-h4qx-73w3
References
More Sharp Corporation Np-cr5450h Firmware vulnerabilities
- TI-2025-10578 Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions… CVSS 4.0CRITICAL 9.5
- TI-2025-10576 Stack-based buffer overflow in Sharp Corporation NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2… CVSS 4.0CRITICAL 9.2
- TI-2025-10575 Path traversal in Sharp Corporation NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG… CVSS 4.0CRITICAL 9.1
Sources
- CVE-2025-11542 · CVE Program
- CVE-2025-11542 · NVD
- FIRST EPSS
- GHSA-7xr9-h4qx-73w3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences