CVE-2024-27145CWE-22

Multiple Post-authenticated Remote Code Execution

Critical · published June 14, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
63.2
In the wild
Unconfirmed
What it is

🚨 An attacker can remotely overwrite any insecure file on a Toshiba printer with just a few clicks! 🔥 Think of it like a mischievous guest at a hotel who finds a way to sneak into the management office and change the room charges for everyone — chaos ensues! With this vulnerability, an attacker could potentially disrupt operations by altering crucial settings and documents stored in the printer, leading to severe data loss or manipulation. It’s a recipe for absolute mayhem when anyone with a nefarious intent can bend the printer to their will!

Put simply

Think of it like a mischievous guest at a hotel who finds a way to sneak into the management office and change the room charges for everyone — chaos ensues! This vulnerability allows remote attackers to exploit insecure file upload mechanisms via the admin web interface, enabling them to overwrite files without proper authorization checks.

What to do

With this vulnerability, an attacker could potentially disrupt operations by altering crucial settings and documents stored in the printer, leading to severe data loss or manipulation. It’s a recipe for absolute mayhem when anyone with a nefarious intent can bend the printer to their will! Immediately secure your Toshiba printers by applying any available firmware updates and reviewing user permissions. Limit access to the admin interface, and consider implementing network segmentation to isolate printers from sensitive internal systems. You've got this! Follow these steps, and you'll have your printers locked down in no time! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01023 · 63.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-06-14T02:33Z
EPSS history
Timeline
  • 14 JUN 02:33Z
    Multiple Post-authenticated Remote Code Execution
    cvelistv5