Vendor
Toshiba Tec
72 known vulnerabilities.
Products
27 results · Clear filters · Feed
-
Medium 6.5CVE-2026-63563 Public exploit
Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication…
-
Medium 5.3
Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain imag…
-
Medium 5.3
The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But c…
-
Medium 5.3
Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administra…
-
Medium 5.9
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved…
-
Medium 5.9
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved…
-
Medium 5.9
User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved…
-
Medium 5.9
Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the…
-
Medium 6.2
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site sc…
-
Medium 5.3
Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability…
-
Medium 4.9
Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperl…
-
Medium 6.7
TOCTOU vulnerability
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.
-
Medium 4.7
Session disclosure inside the log files
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
-
Medium 4.4
Local File Inclusion
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
-
Medium 6.5
Leak of admin password and passwords
Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password…
-
Medium 6.1CVE-2024-27162 EPSS 21%
DOM-based XSS
Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affect…
-
Medium 6.2
Hardcoded password used to encrypt files
all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with…
-
Medium 6.2
Hardcoded password used to encrypt logs and use of weak cipher
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to ex…
-
Medium 6.2
Hardcoded password used to encrypt logs
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to ex…
-
Medium 6.8
Leak of authentication sessions in secure logs
The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
-
Medium 6.8
Leak of authentication sessions in secure logs
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions…
-
Medium 6.2
Passwords are stored in clear-text logs.
Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL.
-
Medium 6.7
Lack of privileges separation
The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.
-
Medium 5.9
Pre-authenticated XXE injection
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacke…
-
Medium 5.9
Pre-authenticated Time-Based Blind XXE injection
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending …
-
Medium 6.1
Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provide…
-
Medium 5.3
Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management …