Toshiba Tec Corporation vulnerabilities, page 3
73 vulnerabilities
Known vulnerabilities in Toshiba Tec Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
CVE-2024-27168toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)
EPSS score0.29%
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.CVE-2024-27163toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.42%
Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
https://www.toshibatec.com/contacts/products/
As for the affected products/models/versions, see the reference URL.CVE-2024-27154toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.25%
Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL.CVE-2024-27153toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.25%
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference URL.CVE-2024-27156toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.44%
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.CVE-2024-27171toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.50%
A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.CVE-2024-27143toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score1.11%
Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this vulnerability will allow any attacker to get a root access on a remote Toshiba printer. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
https://www.toshibatec.com/contacts/products/
As for the affected products/models/versions, see the reference URL.CVE-2024-27173toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score3.17%
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
https://www.toshibatec.com/contacts/products/
As for the affected products/models/versions, see the reference URL.CVE-2024-27146toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.24%
The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.CVE-2024-27152toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.25%
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference URL.CVE-2024-27148toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.25%
The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference URL.CVE-2024-27175toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.85%
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.CVE-2024-27179toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.26%
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.CVE-2024-27145toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score1.02%
The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker can overwrite any insecure files. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
https://www.toshibatec.com/contacts/products/
As for the affected products/models/versions, see the reference URL.CVE-2024-27144toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score1.25%
The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.
https://www.toshibatec.com/contacts/products/
As for the affected products/models/versions, see the reference URL.CVE-2024-27180toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.27%
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.CVE-2024-22475brother industries, ltd.multiple printers and scanners+3EPSS score0.28%
Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a remote unauthenticated attacker to perform unintended operations on the affected product. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-45842sharp corporationsharp digital full-color mfps and monochrome mfps+323EPSS score0.55%
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability.
Unintended internal files may be retrieved when processing crafted HTTP requests.CVE-2024-45829sharp corporationsharp digital full-color mfps and monochrome mfps+323EPSS score0.71%
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-bounds Read vulnerability.
Crafted HTTP requests may cause affected products crashed.CVE-2024-28955sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.31%
Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files, and research the memory contents. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].