CVE-2024-27147 Local Privilege Escalation and Remote Code Execution using snmpd

The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected products/models/versions, see the reference URL...

CVE-2024-27147

CVE-2024-27147 concerns Toshiba Multi-Function Printers (MFPs) with a Local Privilege Escalation that can enable an attacker on a network to remotely compromise the printer via SNMPd-related weaknesses. Public sources consistently describe the vulnerability as affecting Toshiba e-STUDIO/MFP devic...

CVE-2024-27146 Lack of privileges separation

The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL...

CVE-2024-27146

Summary (CVE-2024-27146): The Toshiba printers (notably Toshiba e-STUDIO/MFPs) are affected by a lack of privileges separation. The issue is documented across multiple sources (NVD, CVE lists, OpenVAS entry, and vendor advisories) and is described as the ability for an attacker who can access the...

CVE-2024-27146 Lack of privileges separation

The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL...

CVE-2024-27145 Multiple Post-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker can overwrite any insecure files. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute...

CVE-2024-27145

CVE-2024-27145 affects Toshiba multi-function printers. The vulnerability stems from the admin web interface file upload, enabling remote compromise and the overwriting of insecure files. Connected sources reference multiple CVEs in Toshiba MFPs and describe a post-authenticated/post-attack surfa...

CVE-2024-27145 Multiple Post-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker can overwrite any insecure files. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute...

CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

CVE-2024-27144 Pre-authenticated Remote Code Execution

The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. T...

CVE-2024-27144

CVE-2024-27144 affects Toshiba e-STUDIO/MFPs with web-based management. The vulnerability enables uploading files via the web interface without authentication, allowing overwriting of insecure files and enabling potential remote compromise; a local privilege escalation could lead to full printer ...

CVE-2024-27143

CVE-2024-27143: Toshiba multi-function printers are affected. The issue allows remote code execution with root privileges via SNMP when using the private community, enabling an attacker to gain full control of the printer. Multiple sources confirm a pre-auth remote code execution vector affecting...

CVE-2024-27143 Pre-authenticated Remote Code Execution

Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this vulnerability will allow any attacker to get a root access on a remote Toshiba printer. This vulnerability can be executed in combination...

CVE-2024-27142 Pre-authenticated XXE injection

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity XXE vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve...

CVE-2024-27142 Pre-authenticated XXE injection

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity XXE vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve...

CVE-2024-27142

CVE-2024-27142 affects Toshiba printers’ API endpoint that uses an XML parsing library vulnerable to time-based blind XML External Entity (XXE). The vulnerability can lead to Denial of Service and information disclosure. Connected sources (including NVD/NIST entry) confirm the API/XML handling as...

CVE-2024-27141 Pre-authenticated Time-Based Blind XXE injection

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity XXE vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. A...

CVE-2024-27141

CVE-2024-27141 affects Toshiba printers’ XML API endpoint. The XML parsing library is vulnerable to a time-based blind XML External Entity (XXE) attack, enabling unauthenticated HTTP requests to cause DoS and potentially retrieve information. Connected sources corroborate a multi-vendor vulnerabi...

CVE-2024-27141 Pre-authenticated Time-Based Blind XXE injection

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity XXE vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. A...

Toshiba e-STUDIO Security Vulnerability

Toshiba e-STUDIO is a line of high-end office multifunction printers from Toshiba Japan. A security vulnerability exists in Toshiba e-STUDIO that originates from the use of a Web-based management program TopAccess that can place any file in the multifunction device...