CVE-2024-27168 (GCVE-0-2024-27168)
Vulnerability from cvelistv5 – Published: 2024-06-14 03:53 – Updated: 2025-02-13 17:46
VLAI?
Summary
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.
Severity ?
7.1 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Toshiba Tec Corporation | Toshiba Tec e-Studio multi-function peripheral (MFP) |
Affected:
see the reference URL
|
Credits
We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products.
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-27168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-14T18:49:02.609253Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-14T18:49:09.738Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:27:59.645Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"tags": [
"x_transferred"
],
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
"vendor": "Toshiba Tec Corporation",
"versions": [
{
"status": "affected",
"version": "see the reference URL"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
}
],
"datePublic": "2024-06-14T02:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL."
}
],
"value": "It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
}
],
"value": "We are not aware of any malicious exploitation by these vulnerabilities."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-07-04T05:07:13.094Z",
"orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"shortName": "Toshiba"
},
"references": [
{
"url": "https://www.toshibatec.com/information/20240531_01.html"
},
{
"url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
},
{
"url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
},
{
"url": "http://seclists.org/fulldisclosure/2024/Jul/1"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
}
],
"value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2024-06-14T02:00:00.000Z",
"value": "Fixes will be released"
}
],
"title": "Hardcoded keys used to generate authentication cookies",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"assignerShortName": "Toshiba",
"cveId": "CVE-2024-27168",
"datePublished": "2024-06-14T03:53:58.804Z",
"dateReserved": "2024-02-21T02:11:59.653Z",
"dateUpdated": "2025-02-13T17:46:10.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"descriptions": "[{\"lang\": \"en\", \"value\": \"It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.\"}, {\"lang\": \"es\", \"value\": \"Parece que algunas claves codificadas se utilizan para la autenticaci\\u00f3n en la API interna. Conocer estas claves privadas puede permitir a los atacantes eludir la autenticaci\\u00f3n y llegar a las interfaces administrativas. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia.\"}]",
"id": "CVE-2024-27168",
"lastModified": "2024-11-21T09:04:00.433",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.5, \"impactScore\": 4.0}]}",
"published": "2024-06-14T04:15:34.900",
"references": "[{\"url\": \"http://seclists.org/fulldisclosure/2024/Jul/1\", \"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU97136265/index.html\", \"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"}, {\"url\": \"https://www.toshibatec.com/information/20240531_01.html\", \"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"}, {\"url\": \"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\", \"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"}, {\"url\": \"http://seclists.org/fulldisclosure/2024/Jul/1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU97136265/index.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.toshibatec.com/information/20240531_01.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
"vulnStatus": "Awaiting Analysis",
"weaknesses": "[{\"source\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-798\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-27168\",\"sourceIdentifier\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\",\"published\":\"2024-06-14T04:15:34.900\",\"lastModified\":\"2024-11-21T09:04:00.433\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.\"},{\"lang\":\"es\",\"value\":\"Parece que algunas claves codificadas se utilizan para la autenticaci\u00f3n en la API interna. Conocer estas claves privadas puede permitir a los atacantes eludir la autenticaci\u00f3n y llegar a las interfaces administrativas. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.5,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-798\"}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2024/Jul/1\",\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"},{\"url\":\"https://jvn.jp/en/vu/JVNVU97136265/index.html\",\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"},{\"url\":\"https://www.toshibatec.com/information/20240531_01.html\",\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"},{\"url\":\"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\",\"source\":\"ecc0f906-8666-484c-bcf8-c3b7520a72f0\"},{\"url\":\"http://seclists.org/fulldisclosure/2024/Jul/1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://jvn.jp/en/vu/JVNVU97136265/index.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.toshibatec.com/information/20240531_01.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.toshibatec.com/information/20240531_01.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://jvn.jp/en/vu/JVNVU97136265/index.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"http://seclists.org/fulldisclosure/2024/Jul/1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:27:59.645Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27168\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-14T18:49:02.609253Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-14T18:49:06.784Z\"}}], \"cna\": {\"title\": \"Hardcoded keys used to generate authentication cookies\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products.\"}], \"impacts\": [{\"capecId\": \"CAPEC-37\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-37 Retrieve Embedded Sensitive Data\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Toshiba Tec Corporation\", \"product\": \"Toshiba Tec e-Studio multi-function peripheral (MFP)\", \"versions\": [{\"status\": \"affected\", \"version\": \"see the reference URL\"}], \"platforms\": [\"Linux\"], \"defaultStatus\": \"unaffected\"}], \"exploits\": [{\"lang\": \"en\", \"value\": \"We are not aware of any malicious exploitation by these vulnerabilities.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e\", \"base64\": false}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-06-14T02:00:00.000Z\", \"value\": \"Fixes will be released\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"This issue is fixed in the version released on June 14, 2024 and all later versions.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e\", \"base64\": false}]}], \"datePublic\": \"2024-06-14T02:00:00.000Z\", \"references\": [{\"url\": \"https://www.toshibatec.com/information/20240531_01.html\"}, {\"url\": \"https://www.toshibatec.com/information/pdf/information20240531_01.pdf\"}, {\"url\": \"https://jvn.jp/en/vu/JVNVU97136265/index.html\"}, {\"url\": \"http://seclists.org/fulldisclosure/2024/Jul/1\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798 Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\", \"shortName\": \"Toshiba\", \"dateUpdated\": \"2024-07-04T05:07:13.094Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-27168\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-13T17:46:10.504Z\", \"dateReserved\": \"2024-02-21T02:11:59.653Z\", \"assignerOrgId\": \"ecc0f906-8666-484c-bcf8-c3b7520a72f0\", \"datePublished\": \"2024-06-14T03:53:58.804Z\", \"assignerShortName\": \"Toshiba\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…