CVE-2024-27168
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.
- Affected products
- Toshiba Tec E-Studio Multi-Function Peripheral
- CVSS 3.1
- 7.1 HIGH
- EPSS
- 0.3% (21th percentile)
- Weakness
- CWE-798
- NVD status
- Deferred
- Published
- 2024-06-14
- Attack patterns
- CAPEC-37
- Entry point
- csrfpId request body
- Path
- contentwebserver
Fix
This issue is fixed in the version released on June 14, 2024 and all later versions.
CVE-2024-27168 at NVD
1 known exploit for CVE-2024-27168
Proof-of-concept code and exploit modules indexed by Sploitus