Information disclosure in Toshiba Chec

CVE-2014-4875

CreateBossCredentials.jar in Toshiba CHEC before 6.6 build 4014 and 6.7 before build 4329 contains a hardcoded AES key, which allows attackers to discover Back Office System Server (BOSS) DB2 database credentials by leveraging knowledge of this key in conjunction with bossinfo.pro read access.

Vulnerability class: Information Disclosure

EPSS: 0.021 (79.4th percentile) — read the EPSS interpretation.

Affected products

Toshiba Chec — versions 6.7
N/a — versions n/a

Weakness classification (CWE)

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
cret@cert.org (x_refsource_CONFIRM, US Government Resource, Third Party Advisory)