CVE-2023-7077 is a critical (CVSS 9.8) path traversal flaw in Sharp NEC public displays, including the P403, E705 and X554UN series, that allows remote code execution through HTTP request parameters. The products are out of support, so keep them off the internet and consider replacement.
What's affected
Sharp and NEC list models P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD and MD551C8.
The vendor's page says the product has finished its supported term. The stated workaround is to use the display only in a safe intranet protected by a firewall and not connect it to the internet. No patched firmware is listed on the pages read for this post.
How to check if you're exposed
Make a list of every display of these models. They are often owned by facilities or marketing teams, so ask them directly and check the model labels on site.
Then find out whether any display has a management web interface reachable from the internet or from a wide internal network. Your network scanner or firewall rules will show it. Anything reachable from the internet should be pulled behind a firewall immediately.
What to do now
- Remove these displays from the internet and from general-purpose networks, as the vendor advises.
- Place them on an isolated VLAN with no inbound access except from a management host.
- Plan to replace them, since the vendor lists the products as past their supported term and offers newer models as the alternative.
- Add digital signage and display hardware to your asset inventory.
Why it matters
The description says an attacker can execute remote code by sending unintended parameters in an HTTP request. The record tags CWE-22, path traversal, and the score is 9.8. Devices like these run web servers with root privileges and rarely get updates, which is why a vendor workaround is often network isolation.
Path traversal happens when a program builds a file path from input and does not confirm the result stays inside the folder it meant to use. The fix is to normalize the path, compare it against an allowed base directory, and reject anything that leaves it. Signage and display equipment is a blind spot for many security teams, because it looks like a screen rather than a computer.
Firmware and engineering software update slowly. Start with an inventory of what you run and where it connects. Network isolation buys time while you test and schedule updates, and it is usually the first measure vendors recommend. Give each exception an owner and a review date so the workaround does not become permanent.
Weakness class in the record: CWE-22 (Path Traversal).
Quick check
Is there a patch?
The vendor pages read for this post list a workaround and replacement models, not a patch. Check the vendor's page for updates before you act.
What if we cannot patch quickly?
Reduce who and what can reach the device. Segment the network, restrict management access to a known host, and record the exception with an owner and a review date.
Sources
Last reviewed: 19 October 2026.
