CVE-2024-27168

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Jun 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-271698.4Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, provid CVE-2024-27176.1A vulnerability was found in Campcodes Complete Online DJ Booking System 1.0. It has been declared as problematic. This vulnerability affect CVE-2024-271707.4It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a CVE-2024-271717.4A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for th CVE-2024-271729.8Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL.CVE-2024-271739.8Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This CVE-2024-271749.8Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnera CVE-2024-271754.4Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the CVE-2024-271767.2An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerab CVE-2024-271777.2An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulne CVE-2024-271787.2An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerab CVE-2024-271794.7Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected