CVE-2024-27161: Hardcoded password used to encrypt files
all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27161?
CVE-2024-27161 is considered a high severity vulnerability due to the use of a hardcoded key that can be leveraged by attackers.
How do I fix CVE-2024-27161?
To mitigate CVE-2024-27161, update to the latest firmware provided by Toshiba that addresses this hardcoded key issue.
Which Toshiba printer models are affected by CVE-2024-27161?
CVE-2024-27161 affects all Toshiba printer models that include the vulnerable hardcoded encryption key.
What are the potential impacts of exploiting CVE-2024-27161?
Exploiting CVE-2024-27161 allows attackers to decrypt sensitive files stored on the printers, potentially leading to data breaches.
Is there a workaround for CVE-2024-27161?
Currently, the best workaround for CVE-2024-27161 is to restrict network access to affected printers until the firmware update is applied.