Toshiba Printers Display Admin Password in Clear-Text

CVE-2024-27163

Summary

Toshiba printers exhibit a vulnerability that allows the admin user's password to be revealed in clear-text when two specific HTTP requests are sent to their internal API. This situation poses significant risks, as an attacker who manages to steal an admin's cookie or exploit a related Cross-Site Scripting (XSS) vulnerability can easily retrieve this sensitive information. While the vulnerability itself may not be easily exploitable on its own, it can be leveraged in combination with other vulnerabilities to compromise the printer's security. For further information on affected models and related issues, please contact Toshiba or refer to their official communication channels.

References