CVE-2024-27163 Leak of admin password and passwords

Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the...

CVE-2024-27163 Leak of admin password and passwords

Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password in clear-text and compromise the...

CVE-2024-27163

CVE-2024-27163 affects Toshiba printers (notably MFPs/e-Studio). It exposes admin passwords (and additional passwords) in clear-text when two specific HTTP requests are sent to the internal API; an attacker who can steal an admin cookie or exploit XSS can recover these passwords and compromise th...

CVE-2024-27162

CVE-2024-27162 affects Toshiba printers with a web interface that loads an external JavaScript file containing insecure code. The DOM-based XSS vulnerability could allow an attacker with network access to steal an admin user’s cookies by exploiting the loaded script across the printer’s web pages...

CVE-2024-27162 DOM-based XSS

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the...

CVE-2024-27162 DOM-based XSS

Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affected products/models/versions, see the...

CVE-2024-27161 Hardcoded password used to encrypt files

all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult t...

CVE-2024-27161

CVE-2024-27161 concerns Toshiba multifunction printers (MFPs) with programs containing a hardcoded key used to encrypt files. The root cause is the use of a hardcoded credential and insecure encryption, allowing an attacker who can access the device to decrypt stored/files by using that key. Seve...

CVE-2024-27161 Hardcoded password used to encrypt files

all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult t...

CVE-2024-27160 Hardcoded password used to encrypt logs and use of weak cipher

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for th...

CVE-2024-27160 Hardcoded password used to encrypt logs and use of weak cipher

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for th...

CVE-2024-27160

CVE-2024-27160 affects Toshiba printers. A shell script on affected devices uses a hardcoded key to encrypt logs, allowing an attacker with local access to decrypt encrypted files. Multiple sources corroborate a vulnerability in Toshiba MFPs involving hardcoded credentials/weak crypto, with impac...

CVE-2024-27159 Hardcoded password used to encrypt logs

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for th...

CVE-2024-27159 Hardcoded password used to encrypt logs

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for th...

CVE-2024-27159

CVE-2024-27159 affects Toshiba printers with a shell script that uses a hardcoded key to encrypt logs. An attacker with local access can decrypt the encrypted logs using that key. The issue is documented across multiple sources (CVE record, OpenVAS, and vendor advisories) with remediation guidanc...

CVE-2024-27158 Hardcoded root password

All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL...

CVE-2024-27158

CVE-2024-27158 affects Toshiba printers/MFPs (e.g., e-STUDIO). Root cause is a hardcoded root password shared across affected models. Impact is indicated as high for confidentiality, integrity, and availability, with a local attack vector and no user interaction required (CVSSv3.1: AV=L/AC=H/PR=N...

CVE-2024-27158 Hardcoded root password

All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL...

CVE-2024-27155

Toshiba printers (notably e-STUDIO) are affected by CVE-2024-27155, a Local Privilege Escalation with remote code execution via insecure permissions. The root issue appears to be improper/insecure permissions that allow an attacker to replace programs and potentially gain high-privilege access wi...

CVE-2024-27155 Local Privilege Escalation and Remote Code Execution using insecure permissions

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be replaced by malicious programs by any local or remote attacker. As for the affected products/models/versions, see the reference URL...