CVE-2024-27159

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-27166.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been classified as problematic. This affects an unknown CVE-2024-271606.2All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files us CVE-2024-271616.2all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using t CVE-2024-271626.1Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loade CVE-2024-271636.5Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to CVE-2024-271647.1Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL.CVE-2024-271657.8Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. CVE-2024-271667.4Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected p CVE-2024-271677.4Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject CVE-2024-271687.1It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass au CVE-2024-271698.4Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, provid CVE-2024-27176.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This vulnerability affect