CVE-2024-27159: Hardcoded password used to encrypt logs
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27159?
CVE-2024-27159 is classified as a high severity vulnerability due to the potential for unauthorized access to sensitive log data.
How do I fix CVE-2024-27159?
To mitigate CVE-2024-27159, update your Toshiba printer firmware to the latest version provided by Toshiba.
What are the risks associated with CVE-2024-27159?
The risks include unauthorized exposure of sensitive information contained within encrypted logs due to the hardcoded key.
Is CVE-2024-27159 easy to exploit?
CVE-2024-27159 is difficult to execute in isolation, but can be combined with other vulnerabilities to increase exploitability.
Which devices are affected by CVE-2024-27159?
CVE-2024-27159 affects all Toshiba Printers that utilize the vulnerable shell script with the hardcoded key.