Toshiba Tec e-Studio multi-function peripheral (MFP)
43 known vulnerabilities.
14 results · Clear filters · Feed
-
Medium 6.7
TOCTOU vulnerability
An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL.
-
Medium 4.7
Session disclosure inside the log files
Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
-
Medium 4.4
Local File Inclusion
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
-
Medium 6.5
Leak of admin password and passwords
Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API. An attacker stealing the cookie of an admin or abusing a XSS vulnerability can recover this password…
-
Medium 6.1CVE-2024-27162 EPSS 21%
DOM-based XSS
Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the webpages provided by the printer. An attacker can steal the cookie of an admin user. As for the affect…
-
Medium 6.2
Hardcoded password used to encrypt files
all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. Insecure algorithm is used for the encryption. This vulnerability can be executed in combination with…
-
Medium 6.2
Hardcoded password used to encrypt logs and use of weak cipher
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to ex…
-
Medium 6.2
Hardcoded password used to encrypt logs
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to ex…
-
Medium 6.8
Leak of authentication sessions in secure logs
The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions, see the reference URL.
-
Medium 6.8
Leak of authentication sessions in secure logs
The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the authentication mechanism. As for the affected products/models/versions…
-
Medium 6.2
Passwords are stored in clear-text logs.
Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL.
-
Medium 6.7
Lack of privileges separation
The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL.
-
Medium 5.9
Pre-authenticated XXE injection
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacke…
-
Medium 5.9
Pre-authenticated Time-Based Blind XXE injection
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending …