CVE-2024-27143CWE-250

Pre-authenticated Remote Code Execution

Critical · published June 14, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
65.5
In the wild
Unconfirmed
What it is

🚨 A Toshiba printer could be a hacker's playground! With just the right SNMP configuration, an attacker can execute commands as root — like finding a hidden door to a restricted area. 🔥 Think of it like a restaurant kitchen where anyone with the secret recipe can suddenly start cooking whatever they want. Ignoring this vulnerability is like leaving the kitchen door wide open, inviting unsolicited chefs to whip up trouble! An attacker armed with this vulnerability could take complete control of the printer, issuing commands that could lead to data leaks, unauthorized access to sensitive documents, or even the printer being used in a larger network attack. The potential chaos is absolutely devastating!

Put simply

Think of it like a restaurant kitchen where anyone with the secret recipe can suddenly start cooking whatever they want. Ignoring this vulnerability is like leaving the kitchen door wide open, inviting unsolicited chefs to whip up trouble! This vulnerability allows remote command execution through the SNMP protocol using the private community string, leading to root access on Toshiba printers. Although it’s challenging to exploit in isolation, it can be combined with other vulnerabilities for a more impactful attack.

What to do

An attacker armed with this vulnerability could take complete control of the printer, issuing commands that could lead to data leaks, unauthorized access to sensitive documents, or even the printer being used in a larger network attack. The potential chaos is absolutely devastating! Immediately check for affected models and versions as listed on Toshiba's website. Apply the latest firmware updates to mitigate the risk and enhance SNMP security settings to restrict access. Don't delay in securing your printers! You've got this! Follow these steps to protect your printers and keep your network safe. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01106 · 65.5th percentile
Weakness
CWE-250 · Execution with Unnecessary Privileges
Published
2024-06-14T02:29Z
EPSS history
Timeline
  • 14 JUN 02:29Z
    Pre-authenticated Remote Code Execution
    cvelistv5