CVE-2024-27173: insecure upload
Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to do to achieve code execution?
The attacker must overwrite existing Python files that contain executable code through the Remote Command program. The issue is described as difficult to exploit alone and may need to be combined with other vulnerabilities.
Are all deployments affected by default?
The provided information does not state whether the vulnerable functionality is enabled by default. It directs users to the vendor references for affected products, models, and versions.
Which updates address this issue?
The issue is fixed in versions released on June 14, 2024 and in all later versions.