Toshiba Tec Corporation vulnerabilities, page 4
73 vulnerabilities
Known vulnerabilities in Toshiba Tec Corporation products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 9 products.
CVE-2024-28038sharp corporationmultiple mfps (multifunction printers)+1
EPSS score2.59%
The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-32151sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.25%
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-3496toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.70%
Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As for the affected products/models/versions, see the reference URL.CVE-2024-3497toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.74%
Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the affected products/models/versions, see the reference URL.CVE-2024-3498toshiba tec corporationtoshiba tec e-studio multi-function peripheral (mfp)EPSS score0.32%
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.CVE-2024-34162sharp corporationmultiple mfps (multifunction printers)+1EPSS score0.77%
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPLE", the device communicates with the LDAP server in clear-text. The LDAP password can be retrieved from this clear-text communication. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-35244sharp corporationmultiple mfps (multifunction printers)+1EPSS score1.06%
There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the coredump), these accounts can be used to re-configure the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33616sharp corporationmultiple mfps (multifunction printers)+1EPSS score0.89%
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33605sharp corporationmultiple mfps (multifunction printers)+1EPSS score6.05%
Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2024-33610sharp corporationmultiple mfps (multifunction printers)+1EPSS score50.45%
"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information including session cookies, and "sys_trayentryreboot.html" allows to reboot the device. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].CVE-2026-63563sharp corporationsharp mfps+1EPSS score0.43%
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configuration. When used with the initial configuration, the address book editing and a range of features related to Document Filing can be accessed without user authentication.
Products intended for the Japanese market are not affected.CVE-2026-63545sharp corporationsharp mfps+1EPSS score0.22%
Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users.CVE-2026-60011sharp corporationsharp mfps+1EPSS score0.40%
Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.