Toshiba EStudio Multifunction Printer Authentication Bypass

`============================================================================  
Foofus.net Security Advisory: foofus-20111016  
============================================================================  
Title: Toshiba EStudio Multifunction Printer Authentication Bypass  
Version: e-Studio series devices  
Vendor: Toshiba   
Release Date: 01/29/2010  
Issue Status: Contacted by Vendor on 2/25/2011 about release of a firmware patch.  
============================================================================  
  
1. Summary:  
  
Toshiba e-Studio devices found to be vulnerable to an authentication bypass   
vulnerability.   
  
============================================================================  
  
2. Description:  
  
The authentication is easily bypassed by adding a extra / in the URL after   
TopAccess.  
  
Example:  
http://IP Address/TopAccess//Administrator/Setup/ScanToFile/List.htm  
  
============================================================================  
  
3. Impact:  
  
Exploiting this allows an adversary to gain access to the device via the web   
management interface without authenticating.  
  
============================================================================  
  
4. Affected Products:  
  
All e-Studio devices tested against have been found to be vulnerable as of   
July 2011.   
  
Validation of specific firmware versions have not been conducted.   
This is due to limited access to devices  
  
Note: It is possible devices with latest release of firmware may   
not be vulnerable. These have not been tested.  
  
============================================================================  
  
5. Solution:  
  
Contact vendor and request firmware upgrade to patch security issue.  
  
============================================================================  
  
6) Time Table:  
  
01/29/2011 Reported Vulnerability.   
  
02/25/2011 Vendor acknowledged issue and stated firmware patch would soon   
be available   
  
March - July 2011 continued attempts to contact vendor to confirm firmware   
patch. Request were never answered.  
10/16/2011 Publishes Advisory  
  
============================================================================  
  
7) Credits: Discovered by Deral Heiland PercX   
  
============================================================================  
  
8. Reference:  
http://praeda.foofus.net  
http://www.foofus.net/?page_id=411  
  
  
============================================================================  
  
The Foofus.Net team is an assortment of security professionals located   
through out the United States. http://www.foofus.net  
  
Follow percX on Twitter @Percent_X  
  
============================================================================  
  
`