CVE-2026-32326

published 2026-03-25

CVE-2026-32326: SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password…

Priority P3 37 medium 6.9 CVSS 4.0

AV A AC L AT N PR L UI N VC H VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

SHARP routers do not perform authentication for some web APIs. The device information may be retrieved without authentication. If the administrative password of the device is left as the initial one, the device may be taken over.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
sharp_corporation	5g_mobile_router_sh-u01	—	—
sharp_corporation	home_5g_hr01	—	—
sharp_corporation	home_5g_hr02	—	—
sharp_corporation	pocket_wifi_5g_a503sh	—	—
sharp_corporation	speed_wi-fi_5g_x01	—	—
sharp_corporation	wi-fi_station_sh-52a	—	—
sharp_corporation	wi-fi_station_sh-52b	—	—
sharp_corporation	wi-fi_station_sh-54c	—	—

CVSS provenance

nvd v4.0 6.9 MEDIUM CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

nvd v3.0 5.7 MEDIUM CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-306