Attacker can read any file using Local File Inclusion vulnerability
CVE-2024-27175

4.4MEDIUM

Key Information:

Vendor
Toshiba
Status
Toshiba Tec E-studio Multi-function Peripheral (mfp)
Vendor
CVE Published:
14 June 2024

Summary

Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.

Affected Version(s)

Toshiba Tec e-Studio multi-function peripheral (MFP) Linux see the reference URL

References

https://www.toshibatec.com/information/20240531_01.html
https://www.toshibatec.com/information/pdf/information202...
https://jvn.jp/en/vu/JVNVU97136265/index.html

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products.
.