CVE-2024-27141

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-776

Affected software

VendorProductVersions
Toshiba Tec CorporationToshiba Tec e-Studio multi-function peripheral (MFP)see the reference URL
toshibatece-studio-2521_ac<= *
toshibatece-studio-2020_ac<= *
toshibatece-studio-2520_nc<= *
toshibatece-studio-2021_ac<= *
toshibatece-studio-2525_ac<= *
toshibatece-studio-3025_ac<= *
toshibatece-studio-3525_ac<= *
toshibatece-studio-3525_acg<= *
toshibatece-studio-4525_ac<= *
toshibatece-studio-5525_ac<= *
toshibatece-studio-5525_acg<= *
toshibatece-studio-6525_ac<= *
toshibatece-studio-6525_acg<= *
toshibatece-studio-2528-a<= *
toshibatece-studio-3028-a<= *
toshibatece-studio-3528-a<= *
toshibatece-studio-3528-ag<= *
toshibatece-studio-4528-a<= *
toshibatece-studio-4528-ag<= *
toshibatece-studio-5528-a<= *
toshibatece-studio-6528-a<= *
toshibatece-studio-6526-ac<= *
toshibatece-studio-6527-ac<= *
toshibatece-studio-7527-ac<= *
toshibatece-studio-6529-a<= *
toshibatece-studio-7529-a<= *
toshibatece-studio-9029-a<= *
toshibatece-studio-330-ac<= *
toshibatece-studio-400-ac<= *
toshibatece-studio-2010-ac<= *
toshibatece-studio-2110-ac<= *
toshibatece-studio-2510-ac<= *
toshibatece-studio-2610-ac<= *
toshibatece-studio-2015-nc<= *
toshibatece-studio-2515-nc<= *
toshibatece-studio-2615-nc<= *
toshibatece-studio-3015-nc<= *
toshibatece-studio-3115-nc<= *
toshibatece-studio-3515-nc<= *
toshibatece-studio-3615-nc<= *
toshibatece-studio-4515_ac<= *
toshibatece-studio-4615_ac<= *

References

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-271425.9Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it isCVE-2024-271439.8Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote CVE-2024-271449.8The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any inseCVE-2024-271459.8The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba priCVE-2024-271466.7The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.CVE-2024-271477.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271487.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271497.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-27156.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0 and classified as problematic. Affected by this issue is some uCVE-2024-271507.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271517.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. CVE-2024-271527.4The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer.
CVE-2024-27141: Medium severity, CVSS 5.9 | Vulnix