CVE-2024-27159: Hardcoded password used to encrypt logs
First published: Fri Jun 14 2024(Updated: )
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
Credit: ecc0f906-8666-484c-bcf8-c3b7520a72f0
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Toshiba Printer |
Remedy
This issue is fixed in the version released on June 14, 2024 and all later versions.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-27159?
CVE-2024-27159 is classified as a high severity vulnerability due to the potential for unauthorized access to sensitive log data.
How do I fix CVE-2024-27159?
To mitigate CVE-2024-27159, update your Toshiba printer firmware to the latest version provided by Toshiba.
What are the risks associated with CVE-2024-27159?
The risks include unauthorized exposure of sensitive information contained within encrypted logs due to the hardcoded key.
Is CVE-2024-27159 easy to exploit?
CVE-2024-27159 is difficult to execute in isolation, but can be combined with other vulnerabilities to increase exploitability.
Which devices are affected by CVE-2024-27159?
CVE-2024-27159 affects all Toshiba Printers that utilize the vulnerable shell script with the hardcoded key.
- agent/remedy
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- agent/event
- agent/references
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/toshiba
- canonical/toshiba printer