CVE-2025-11543 is a critical (CVSS 9.8) integrity check flaw in Sharp Display Solutions projectors, including the NP-CR5450 series, that may let an attacker create and run unauthorized firmware. Sharp offers a workaround and no confirmed fixed firmware: keep projectors on a firewalled intranet and off the internet.
What's affected
The CVE record lists the Sharp NP-CR5450H, NP-CR5450HL, NP-CR5450W and NP-CR5450WL projectors and their firmware. Sharp's advisory is wider. It covers four CVE identifiers (CVE-2025-11540 to CVE-2025-11543) in one notice and names these models: NP-P502HL-2, NP-P502WL-2, NP-P502HLG-2, NP-P502WLG, NP-P502H, NP-P502W, NP-P452H, NP-P452W, NP-P502HG, NP-P502WG, NP-P452HG, NP-P452WG, NP-P502H+, NP-P502W+, NP-CR5450H, NP-CR5450W, NP-P502HL, NP-P502WL, NP-P502HLG, NP-P502HL+, NP-P502WL+, NP-CR5450HL, NP-CR5450WL, NP-UM352W, NP-UM352WG and NP-UM352W+.
This one differs from its two siblings. It is classified as CWE-354 (improper validation of integrity check value), meaning the device does not properly verify that firmware is genuine before accepting it. The record describes the result as an attacker being able to create and run unauthorized firmware.
The advisory page gives a workaround and does not state a fixed firmware version. Check the advisory and Sharp support for your model before assuming a patch exists. The CVSS base score is 9.8 (Critical) with a network attack vector, no privileges and no user interaction.
How to check if you're exposed
There is no package manager for a projector, so exposure comes down to model and network position.
- Read the model number on the label or in the on-screen menu and compare it with the advisory list above.
- Find out whether the projector is reachable from anywhere other than a tightly controlled network. Look at your switch ports, DHCP leases and any port forwards on your firewall.
- Use your normal network inventory tool to see which management interfaces the projector answers on. Do not probe devices you do not own. Because this flaw concerns firmware, also note who has physical or network access to update the unit, and whether any projector management software is installed on shared computers.
- Record the firmware version shown in the projector menu and keep it with the asset record, so you can compare it with whatever Sharp publishes later.
What to do now
- Identify every Sharp projector in the advisory list, including ceiling mounted units in meeting rooms and training spaces that nobody thinks of as computers.
- Apply the vendor workaround: use the product only in a safe intranet protected by a firewall, and do not connect it to the internet. Remove any port forward or public address that points at a projector.
- Move projectors to their own network segment or VLAN, and allow only the presentation and management hosts that need them.
- Watch the Sharp advisory for firmware and update when it appears. Review the release notes first and keep a rollback plan for rooms in daily use.
- Add projectors and other network displays to your asset inventory so the next advisory is a five minute lookup.
Why it matters
Firmware is the lowest layer the device trusts. If a projector accepts firmware that has not been properly verified, an attacker who reaches the update path can replace the software with their own, and the change survives a reboot. Normal cleanup steps like resetting settings do not remove it.
That is why integrity checks exist. A signature or checksum is only useful if the device checks it against something the attacker cannot forge. The record points to a weakness in that validation without giving more detail, and Sharp's advisory does not either. We will not guess at the mechanism.
For defenders, the practical takeaway is containment and visibility. Keep projectors off the internet, limit who can reach them on the internal network, and record firmware versions so any later vendor update can be verified. The record is not a CISA KEV entry and no source reports exploitation.
Quick check
What does improper validation of an integrity check value mean?
The device does not correctly verify that a firmware image is authentic and unmodified before accepting it. That allows unauthorized firmware to be created and run.
Do I need to replace the projector?
Not on the evidence we have. The advisory gives a network workaround. Check Sharp support for updated firmware for your model before deciding.
Sources
- Sharp Display Solutions advisory, Multiple vulnerabilities in projectors
- CVE record and CVSS vector for CVE-2025-11543, published 2025-12-22
Last reviewed: 19 October 2026.
