CVE-2024-27144CWE-22CWE-276

Pre-authenticated Remote Code Execution

Critical · published June 14, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
69.1
In the wild
Unconfirmed
What it is

🚨 A Toshiba printer can be manipulated without even breaking a sweat — no authentication needed to upload files! 🔥 Think of it like a restaurant where anyone can place orders without checking in, leading to a chaotic kitchen where rogue ingredients can ruin everyone’s meal. That's what this vulnerability allows — unauthorized uploads and malicious substitutions in the printer's system! An attacker could wreak absolute havoc by replacing crucial printer programs with malicious ones. Imagine a printer controlled by an intruder, sending out documents with hidden exploits or altering important files — a nightmare scenario for any organization!

Put simply

Think of it like a restaurant where anyone can place orders without checking in, leading to a chaotic kitchen where rogue ingredients can ruin everyone’s meal. That's what this vulnerability allows — unauthorized uploads and malicious substitutions in the printer's system! This vulnerability allows unauthorized file uploads to Toshiba printers, enabling attackers to overwrite insecure files. It also opens the door to Local Privilege Escalation, empowering local or remote attackers to hijack the printer's functionality and execute arbitrary code.

What to do

An attacker could wreak absolute havoc by replacing crucial printer programs with malicious ones. Imagine a printer controlled by an intruder, sending out documents with hidden exploits or altering important files — a nightmare scenario for any organization! Immediately patch your Toshiba printers to the latest firmware version provided by Toshiba. Ensure that file upload functionalities are secured with authentication, and regularly audit access controls on your printer's web interface. Don't forget to review your network security policies! You've got this! Secure your printers and protect your network — with a little effort, you can be a security hero! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01247 · 69.1th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-276 · Incorrect Default Permissions
Published
2024-06-14T02:31Z
EPSS history
Timeline
  • 14 JUN 02:31Z
    Pre-authenticated Remote Code Execution
    cvelistv5