CVE-2024-27160: Hardcoded password used to encrypt logs and use of weak cipher
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27160?
CVE-2024-27160 is considered a moderate severity vulnerability due to the use of a hardcoded key for encrypting logs in Toshiba printers.
How do I fix CVE-2024-27160?
To mitigate CVE-2024-27160, it is recommended to update your Toshiba printer firmware to the latest version provided by the manufacturer.
What is the impact of CVE-2024-27160?
CVE-2024-27160 allows attackers to decrypt sensitive log files due to the use of a shared hardcoded key, potentially exposing confidential information.
Which Toshiba printer models are affected by CVE-2024-27160?
CVE-2024-27160 affects all Toshiba printer models that utilize the vulnerable shell script with the hardcoded encryption key.
Can CVE-2024-27160 be exploited remotely?
CVE-2024-27160 typically requires local access to exploit, but it can be combined with other vulnerabilities to enable more extensive exploitation.