FKIE_CVE-2024-27160

Vulnerability from fkie_nvd - Published: 2024-06-14 04:15 - Updated: 2024-11-21 09:03
Severity ?
6.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the "Base Score" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point. https://www.toshibatec.com/contacts/products/ As for the affected products/models/versions, see the reference URL.
References
ecc0f906-8666-484c-bcf8-c3b7520a72f0http://seclists.org/fulldisclosure/2024/Jul/1
ecc0f906-8666-484c-bcf8-c3b7520a72f0https://jvn.jp/en/vu/JVNVU97136265/index.html
ecc0f906-8666-484c-bcf8-c3b7520a72f0https://www.toshibatec.com/information/20240531_01.html
ecc0f906-8666-484c-bcf8-c3b7520a72f0https://www.toshibatec.com/information/pdf/information20240531_01.pdf
af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2024/Jul/1
af854a3a-2127-422b-91ae-364da2661108https://jvn.jp/en/vu/JVNVU97136265/index.html
af854a3a-2127-422b-91ae-364da2661108https://www.toshibatec.com/information/20240531_01.html
af854a3a-2127-422b-91ae-364da2661108https://www.toshibatec.com/information/pdf/information20240531_01.pdf
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded key. This vulnerability can be executed in combination with other vulnerabilities and  difficult to execute alone. So, the CVSS score for this vulnerability alone is lower than the score listed in the \"Base Score\" of this vulnerability. For detail on related other vulnerabilities, please ask to the below contact point.\n https://www.toshibatec.com/contacts/products/ \nAs for the affected products/models/versions, see the reference URL."
    },
    {
      "lang": "es",
      "value": "Todas las impresoras Toshiba contienen un script de shell que utiliza la misma clave codificada para cifrar los registros. Un atacante puede descifrar los archivos cifrados utilizando la clave codificada. Esta vulnerabilidad se puede ejecutar en combinaci\u00f3n con otras vulnerabilidades y es dif\u00edcil de ejecutar sola. Por lo tanto, la puntuaci\u00f3n CVSS para esta vulnerabilidad por s\u00ed sola es inferior a la puntuaci\u00f3n que figura en la \"Puntuaci\u00f3n base\" de esta vulnerabilidad. Para obtener detalles sobre otras vulnerabilidades relacionadas, consulte al siguiente punto de contacto. https://www.toshibatec.com/contacts/products/ En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."
    }
  ],
  "id": "CVE-2024-27160",
  "lastModified": "2024-11-21T09:03:59.143",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 3.6,
        "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-06-14T04:15:31.183",
  "references": [
    {
      "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
    },
    {
      "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
    },
    {
      "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "url": "https://www.toshibatec.com/information/20240531_01.html"
    },
    {
      "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.toshibatec.com/information/20240531_01.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
    }
  ],
  "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ],
      "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.