Toshiba Tec Corporation vulnerabilities

73 vulnerabilities

Known vulnerabilities in Toshiba Tec Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.

Products

9
8.5CVE-2025-49797brother industries, ltd.multiple driver installers for windows+2
EPSS score
0.18%
Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].5.3CVE-2024-21824brother industries, ltd.multiple printers and scanners+3
EPSS score
0.34%
Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. If this vulnerability is exploited, a network-adjacent user who can access the product may impersonate an administrative user. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].8.1CVE-2024-47005sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.46%
Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A non-administrative user may execute some configuration APIs.7.4CVE-2024-47801sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.36%
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.7.4CVE-2024-47549sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.36%
Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Accessing a crafted URL which points to an affected product may cause malicious script executed on the web browser.9.8CVE-2024-47406sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.62%
Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability.7.5CVE-2024-42420sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.75%
Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of SOAP messages. Crafted HTTP requests may cause affected products crashed.6.2CVE-2024-48870sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.35%
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users.7.4CVE-2024-36249sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
0.53%
Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].7.5CVE-2024-36254sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
0.72%
Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-service (DoS) condition.9.1CVE-2024-36248sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
1.06%
API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].7.5CVE-2024-36251sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
3.50%
The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedef_sub_sel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].7.5CVE-2024-43424sharp corporationsharp digital full-color mfps and monochrome mfps+323
EPSS score
0.75%
Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected products crashed.8.7CVE-2024-58388sharp corporationmultiple multifunction printers+1
EPSS score
0.81%
Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installed_emanual_down.html endpoint. Attackers can supply directory traversal sequences such as path=/manual/../../../<path> to access files outside the intended manual directory, including /etc/passwd, coredump files containing credentials, and system configuration files. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.5.9CVE-2024-29978sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
1.25%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].5.9CVE-2024-29146sharp corporationmultiple mfps (multifunction printers)+1
EPSS score
0.83%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].5.9CVE-2024-27142toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)
EPSS score
0.92%
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.7.4CVE-2024-27151toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)
EPSS score
0.40%
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference URL.7.2CVE-2024-27178toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)
EPSS score
1.50%
An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.7.4CVE-2024-27170toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)
EPSS score
0.27%
It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected products/models/versions, see the reference URL.