CVE-2024-27161: toshiba tec corporation toshiba tec e-studio multi-function peripheral (mfp) Use of Hard-coded Credentials

Vulnerability summary

CVE-2024-27161 is a medium (CVSS 6.2) Use of Hard-coded Credentials vulnerability in toshiba tec corporation toshiba tec e-studio multi-function peripheral (mfp). EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.3% of scored vulnerabilities.

Timeline

1. 14-06-2024
   PublishedVulnerability first disclosed.
2. 13-02-2025
   Last modifiedVulnerability information updated.

Description

all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.

• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.