Toshiba Tec Corporation
72 CVEs across 8 Toshiba Tec Corporation products. Browse Toshiba Tec Corporation vulnerabilities, severities, and proof-of-concept exploits.
Toshiba Tec Corporation products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63563 | Medium | 6.5 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) for a certain market have been shipped with the user authentication feature disabled in the initial configu… |
CVE-2026-63545 | Low | 2.4 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. |
CVE-2026-60011 | Medium | 5.3 | 2026-08-03 | Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. |
CVE-2025-49797 | High | 7.8 | 2025-06-25 | Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the admini… |
CVE-2024-36254 | High | 7.5 | 2024-11-26 | Out-of-bounds read vulnerability exists in Sharp Corporation and Toshiba Tec Corporation multiple MFPs (multifunction printers), which may lead to a denial-of-… |
CVE-2024-36251 | High | 7.5 | 2024-11-26 | The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to bill… |
CVE-2024-36249 | High | 7.4 | 2024-11-26 | Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs (multifunction printers). If this vulnerability is ex… |
CVE-2024-36248 | Critical | 9.1 | 2024-11-26 | API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the in… |
CVE-2024-35244 | Critical | 9.1 | 2024-11-26 | There are several hidden accounts. Some of them are intended for maintenance engineers, and with the knowledge of their passwords (e.g., by examining the cored… |
CVE-2024-34162 | Medium | 5.3 | 2024-11-26 | The web interface of the affected devices is designed to hide the LDAP credentials even for administrative users. But configuring LDAP authentication to "SIMPL… |
CVE-2024-33616 | Medium | 5.3 | 2024-11-26 | Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states… |
CVE-2024-33610 | Critical | 9.1 | 2024-11-26 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. "sessionlist.html" provides logged-in users' session information inclu… |
CVE-2024-33605 | High | 7.5 | 2024-11-26 | Improper processing of some parameters of installed_emanual_list.html leads to a path traversal vulnerability. As for the details of affected product names, mo… |
CVE-2024-32151 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29978 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-29146 | Medium | 5.9 | 2024-11-26 | User passwords are decrypted and stored on memory before any user logged in. Those decrypted passwords can be retrieved from the coredump file. As for the deta… |
CVE-2024-28955 | Medium | 5.9 | 2024-11-26 | Affected devices create coredump files when crashed, storing them with world-readable permission. Any local user of the device can examine the coredump files… |
CVE-2024-28038 | Critical | 9.0 | 2024-11-26 | The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character st… |
CVE-2024-48870 | Medium | 6.2 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input… |
CVE-2024-47801 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, resulting in a reflected cross-site scripting vulnerability. Accessing a craf… |
CVE-2024-47549 | High | 7.4 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process query parameters in HTTP requests, which may allow contamination of unintended data to HTTP response headers. Ac… |
CVE-2024-47406 | Critical | 9.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP authentication requests, resulting in an authentication bypass vulnerability. |
CVE-2024-47005 | High | 8.1 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide configuration related APIs. They are expected to be called by administrative users only, but insufficiently restricted. A n… |
CVE-2024-45842 | Medium | 5.3 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process URI data in HTTP PUT requests resulting in a path Traversal vulnerability. Unintended internal files may be retr… |
CVE-2024-45829 | Medium | 4.9 | 2024-10-25 | Sharp and Toshiba Tec MFPs provide the web page to download data, where query parameters in HTTP requests are improperly processed and resulting in an Out-of-b… |
CVE-2024-43424 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs improperly process HTTP request headers, resulting in an Out-of-bounds Read vulnerability. Crafted HTTP requests may cause affected… |
CVE-2024-42420 | High | 7.5 | 2024-10-25 | Sharp and Toshiba Tec MFPs contain multiple Out-of-bounds Read vulnerabilities, due to improper processing of keyword search input and improper processing of S… |
CVE-2024-3498 | High | 7.8 | 2024-06-14 | Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As fo… |
CVE-2024-3497 | High | 8.8 | 2024-06-14 | Path traversal vulnerability in the web server of the Toshiba printer enables attacker to overwrite orginal files or add new ones to the printer. As for the af… |
CVE-2024-3496 | High | 8.8 | 2024-06-14 | Attackers can bypass the web login authentication process to gain access to the printer's system information and upload malicious drivers to the printer. As fo… |
CVE-2024-27180 | Medium | 6.7 | 2024-06-14 | An attacker with admin access can install rogue applications. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27179 | Medium | 4.7 | 2024-06-14 | Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication mechanism. As for the affected products/models/ver… |
CVE-2024-27178 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying file name variable. This vulnerability can be execut… |
CVE-2024-27177 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying package name variable. This vulnerability can be exe… |
CVE-2024-27176 | High | 7.2 | 2024-06-14 | An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying session ID variable. This vulnerability can be execut… |
CVE-2024-27175 | Medium | 4.4 | 2024-06-14 | Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the… |
CVE-2024-27174 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in combination with other vulnerabilities and diffi… |
CVE-2024-27173 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution by overwriting existing Python files containing executable code. This vulnerability can… |
CVE-2024-27172 | Critical | 9.8 | 2024-06-14 | Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27171 | High | 7.4 | 2024-06-14 | A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products… |
CVE-2024-27170 | High | 7.4 | 2024-06-14 | It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with W… |
CVE-2024-27169 | High | 8.4 | 2024-06-14 | Toshiba printers provides API without authentication for internal access. A local attacker can bypass authentication in applications, providing administrative… |
CVE-2024-27168 | High | 7.1 | 2024-06-14 | It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and re… |
CVE-2024-27167 | High | 7.4 | 2024-06-14 | Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories. A local attacker can inject a malicious Sendmai… |
CVE-2024-27166 | High | 7.4 | 2024-06-14 | Coredump binaries in Toshiba printers have incorrect permissions. A local attacker can steal confidential information. As for the affected products/models/vers… |
CVE-2024-27165 | High | 7.8 | 2024-06-14 | Toshiba printers contain a suidperl binary and it has a Local Privilege Escalation vulnerability. A local attacker can get root privileges. As for the affected… |
CVE-2024-27164 | High | 7.1 | 2024-06-14 | Toshiba printers contain hardcoded credentials. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27163 | Medium | 6.5 | 2024-06-14 | Toshiba printers will display the password of the admin user in clear-text and additional passwords when sending 2 specific HTTP requests to the internal API… |
CVE-2024-27162 | Medium | 6.1 | 2024-06-14 | Toshiba printers provide a web interface that will load the JavaScript file. The file contains insecure codes vulnerable to XSS and is loaded inside all the we… |
CVE-2024-27161 | Medium | 6.2 | 2024-06-14 | all the Toshiba printers have programs containing a hardcoded key used to encrypt files. An attacker can decrypt the encrypted files using the hardcoded key. I… |
CVE-2024-27160 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27159 | Medium | 6.2 | 2024-06-14 | All the Toshiba printers contain a shell script using the same hardcoded key to encrypt logs. An attacker can decrypt the encrypted files using the hardcoded k… |
CVE-2024-27158 | High | 7.4 | 2024-06-14 | All the Toshiba printers share the same hardcoded root password. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27157 | Medium | 6.8 | 2024-06-14 | The sessions are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve the credentials and bypass the aut… |
CVE-2024-27156 | Medium | 6.8 | 2024-06-14 | The session cookies, used for authentication, are stored in clear-text logs. An attacker can retrieve authentication sessions. A remote attacker can retrieve t… |
CVE-2024-27155 | High | 7.7 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-27154 | Medium | 6.2 | 2024-06-14 | Passwords are stored in clear-text logs. An attacker can retrieve passwords. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27153 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27152 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27151 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. The programs can be… |
CVE-2024-27150 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27149 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27148 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27147 | High | 7.4 | 2024-06-14 | The Toshiba printers are vulnerable to a Local Privilege Escalation vulnerability. An attacker can remotely compromise any Toshiba printer. As for the affected… |
CVE-2024-27146 | Medium | 6.7 | 2024-06-14 | The Toshiba printers do not implement privileges separation. As for the affected products/models/versions, see the reference URL. |
CVE-2024-27145 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the admin web interface. An attacker can remotely compromise any Toshiba printer. An attacker c… |
CVE-2024-27144 | Critical | 9.8 | 2024-06-14 | The Toshiba printers provide several ways to upload files using the web interface without authentication. An attacker can overwrite any insecure files. And the… |
CVE-2024-27143 | Critical | 9.8 | 2024-06-14 | Toshiba printers use SNMP for configuration. Using the private community, it is possible to remotely execute commands as root on the remote printer. Using this… |
CVE-2024-27142 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2024-27141 | Medium | 5.9 | 2024-06-14 | Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a ti… |
CVE-2024-22475 | Medium | 6.1 | 2024-03-18 | Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. allows a r… |
CVE-2024-21824 | Medium | 5.3 | 2024-03-18 | Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. If… |