CVE-2024-27142mediumCWE-776

CVE-2024-27142: medium-severity vulnerability in Toshiba Tec e-Studio multi-function peripheral…

Pre-authenticated XXE injection

Published · Updated

Follow this CVE+ Monitor Toshiba Tec e-Studio multi-function peripheral

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.9epss 0.9%
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Toshiba Tec Corporation · Toshiba Tec e-Studio multi-function peripheral (MFP)
Related CVEs — Toshiba Tec e-Studio multi-function peripheral…

In the same product, most dangerous first.

CVE-2024-27172CRITICALRemote Code ExecutionEPSS 26.8%CVE-2024-27162MEDIUMDOM-based XSSEPSS 21.2%CVE-2024-27173CRITICALinsecure uploadEPSS 3.2%CVE-2024-27174CRITICALinsecure uploadEPSS 1.6%CVE-2024-27178HIGHRemote Code ExecutionEPSS 1.5%CVE-2024-27177HIGHRemote Code ExecutionEPSS 1.5%