High severity · published Jun 14, 2024
CVE-2024-27168
Hardcoded keys used to generate authentication cookies
7.1
CVSS
0.3%
EPSS
No
On KEV
Description
It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TT
Toshiba Tec e-Studio multi-function peripheral (MFP) · Toshiba Tec Corporation
see the reference URL · source: vendor
Affected product
TT
Toshiba Tec e-Studio multi-function peripheral (MFP)
Toshiba Tec Corporation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27168
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27168
seclists.org
http://seclists.org/fulldisclosure/2024/Jul/1
jvn.jp
https://jvn.jp/en/vu/JVNVU97136265/index.html
www.toshibatec.com
https://www.toshibatec.com/information/20240531_01.html
www.toshibatec.com
https://www.toshibatec.com/information/pdf/information20240531_01.pdf
More from Toshiba Tec e-Studio multi-function peripheral (MFP)
9.8
CVE-2024-27174
insecure upload
9.8
CVE-2024-27173
insecure upload
9.8
CVE-2024-27172
Remote Code Execution
9.8
CVE-2024-27145
Multiple Post-authenticated Remote Code Execution
9.8
CVE-2024-27144
Pre-authenticated Remote Code Execution