CVE-2024-27144

🗓️ 14 Jun 2024 02:31:58Reported by ToshibaType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 85 Views🌐 WEB

Toshiba printers web interface allows file upload without authentication. Local & remote attackers can compromise and escalate privileges

Reporter	Title	Published	Views	Family All 10
CNNVD	Toshiba e-STUDIO Security Vulnerability	14 Jun 202400:00	–	cnnvd
Cvelist	CVE-2024-27144 Pre-authenticated Remote Code Execution	14 Jun 202402:31	–	cvelist
EUVD	EUVD-2024-24385	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	Multiple vulnerabilities in Toshiba Tec and Oki Electric Industry MFPs	17 Jun 202406:21	–	jvn
NVD	CVE-2024-27144	14 Jun 202403:15	–	nvd
OpenVAS	Toshiba Printers Multiple Vulnerabilities (May 2024)	8 Jul 202400:00	–	openvas
Packet Storm	Toshiba Multi-Function Printers 40 Vulnerabilities	4 Jul 202400:00	–	packetstorm
Positive Technologies	PT-2024-21675 · Toshiba · Toshiba Printers	13 Jun 202400:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2024-27144: Improper Limitation of a Pathname to a Restricted Directory	14 Jun 202400:00	–	rapid7
Vulnrichment	CVE-2024-27144 Pre-authenticated Remote Code Execution	14 Jun 202402:31	–	vulnrichment

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Linux"
    ],
    "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
    "vendor": "Toshiba Tec Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "see the reference URL"
      }
    ]
  }
]

Source	Link
toshibatec	www.toshibatec.com/information/20240531_01.html
seclists	www.seclists.org/fulldisclosure/2024/Jul/1
toshibatec	www.toshibatec.com/information/pdf/information20240531_01.pdf
jvn	www.jvn.jp/en/vu/JVNVU97136265/index.html

Parameter	Position	Path	Description	CWE
XML payload with XXE	request body	/contentwebserver	Pre-authenticated Blind XXE injection (XML External Entity) in printer's content webserver endpoint	CWE-22, CWE-276
/./../../../../../home/SYSROM_SRC/sbin/malicious.program	path	/contentwebserver/upload	Upload of a malicious program via the content webserver upload API to overwrite root-owned files and enable RCE	CWE-22, CWE-276
Session	header	/tapy/server/appmgmt/applistDeployed	Pre-authenticated Remote Code Execution via appmgmt endpoint exploiting a session cookie	CWE-22, CWE-276
/./../../../../../home/SYSROM_SRC/build/common/bin/networkservice/ldapserver	path	/Administration/maintenance/uploadsoft/DriverCustomize.html	Upload of a malicious ldapserver shell script via admin upload form with path traversal	CWE-22, CWE-276
/./../../../../../home/SYSROM_SRC/sbin/malicious.program	path	/Administration/maintenance/uploadsoft/UnixList.html	Upload of a malicious program via admin upload form with path traversal	CWE-22, CWE-276
/registration/al/TopAccessPy/server/screenfacade/appmgmt/views.py	path	/contentwebserver/upload	Remote Code Execution - Upload of a malicious Python script inside WSGI Python programs by overwriting server-side code	CWE-22, CWE-276
/registration/al/WebPanel/development.ini	path	/contentwebserver/upload	Remote Code Execution - Overwrite insecure WSGI configuration files with uploaded content	CWE-22, CWE-276
/registration/al/TopAccessPy/development.ini	path	/contentwebserver/upload	Remote Code Execution - Overwrite insecure WSGI configuration files with uploaded content	CWE-22, CWE-276
/home/SYSROM_SRC/build/release/bin/sapphost.py	path	/contentwebserver/upload	Remote Code Execution - Overwrite /home/SYSROM_SRC/build/release/bin/sapphost.py by uploading malicious code	CWE-22, CWE-276
/ramdisk/al/libGetNameInfoInterface.so	path	/contentwebserver/upload	Remote Code Execution - Overwrite LD_PRELOAD libraries to execute as root	CWE-22, CWE-276

17 Jun 2026 07:19Current

9.6Critical risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.01247

SSVC