CVE-2024-27142: toshiba tec corporation toshiba tec e-studio multi-function peripheral (mfp) XML Entity Expansion

Vulnerability summary

CVE-2024-27142 is a medium (CVSS 5.9) XML Entity Expansion vulnerability in toshiba tec corporation toshiba tec e-studio multi-function peripheral (mfp). EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.8% of scored vulnerabilities.

Timeline

1. 14-06-2024
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.

• CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.