CVE Feed

    Dashboard / CVE / CVE-2024-27171

    CVE-2024-27171

    A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.

    Published:Jun 14, 2024
    Last Modified:Apr 15, 2026
    EPS:Jun 14, 2024
    EPSS Score:0.01695
    CVSS Score:7.4

    Affected Products

    Vendor
    Toshibatec
    Product
    E-studio-2010-ac
    Vendor
    Toshibatec
    Product
    E-studio-2015-nc
    Vendor
    Toshibatec
    Product
    E-studio-2020 Ac
    Vendor
    Toshibatec
    Product
    E-studio-2021 Ac
    Vendor
    Toshibatec
    Product
    E-studio-2110-ac
    Vendor
    Toshibatec
    Product
    E-studio-2510-ac
    Vendor
    Toshibatec
    Product
    E-studio-2515-nc
    Vendor
    Toshibatec
    Product
    E-studio-2520 Nc
    Vendor
    Toshibatec
    Product
    E-studio-2521 Ac
    Vendor
    Toshibatec
    Product
    E-studio-2525 Ac
    Vendor
    Toshibatec
    Product
    E-studio-2528-a
    Vendor
    Toshibatec
    Product
    E-studio-2610-ac
    Vendor
    Toshibatec
    Product
    E-studio-2615-nc
    Vendor
    Toshibatec
    Product
    E-studio-3015-nc
    Vendor
    Toshibatec
    Product
    E-studio-3025 Ac
    Vendor
    Toshibatec
    Product
    E-studio-3028-a
    Vendor
    Toshibatec
    Product
    E-studio-3115-nc
    Vendor
    Toshibatec
    Product
    E-studio-330-ac
    Vendor
    Toshibatec
    Product
    E-studio-3515-nc
    Vendor
    Toshibatec
    Product
    E-studio-3525 Ac
    Vendor
    Toshibatec
    Product
    E-studio-3525 Acg
    Vendor
    Toshibatec
    Product
    E-studio-3528-a
    Vendor
    Toshibatec
    Product
    E-studio-3528-ag
    Vendor
    Toshibatec
    Product
    E-studio-3615-nc
    Vendor
    Toshibatec
    Product
    E-studio-400-ac
    Vendor
    Toshibatec
    Product
    E-studio-4525 Ac
    Vendor
    Toshibatec
    Product
    E-studio-4528-a
    Vendor
    Toshibatec
    Product
    E-studio-4528-ag
    Vendor
    Toshibatec
    Product
    E-studio-5525 Ac
    Vendor
    Toshibatec
    Product
    E-studio-5525 Acg
    Vendor
    Toshibatec
    Product
    E-studio-5528-a
    Vendor
    Toshibatec
    Product
    E-studio-6525 Ac
    Vendor
    Toshibatec
    Product
    E-studio-6525 Acg
    Vendor
    Toshibatec
    Product
    E-studio-6526-ac
    Vendor
    Toshibatec
    Product
    E-studio-6527-ac
    Vendor
    Toshibatec
    Product
    E-studio-6528-a
    Vendor
    Toshibatec
    Product
    E-studio-6529-a
    Vendor
    Toshibatec
    Product
    E-studio-7527-ac
    Vendor
    Toshibatec
    Product
    E-studio-7529-a
    Vendor
    Toshibatec
    Product
    E-studio-9029-a

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Related CVEs

    CVE-2024-27180 (CVSS 6.7) — An attacker with admin access can install rogue applications. As for the affected products/models/versions, se…
    CVE-2024-27179 (CVSS 4.7) — Admin cookies are written in clear-text in logs. An attacker can retrieve them and bypass the authentication m…
    CVE-2024-27178 (CVSS 7.2) — An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying fil…
    CVE-2024-27177 (CVSS 7.2) — An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying pac…
    CVE-2024-27176 (CVSS 7.2) — An attacker can get Remote Code Execution by overwriting files. Overwriting files is enable by falsifying sess…
    CVE-2024-27174 (CVSS 9.8) — Remote Command program allows an attacker to get Remote Code Execution. This vulnerability can be executed in …
    CVE-2024-27172 (CVSS 9.8) — Remote Command program allows an attacker to get Remote Code Execution. As for the affected products/models/ve…
    CVE-2024-27170 (CVSS 7.4) — It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file.…
    CVE-2024-27169 (CVSS 8.4) — Toshiba printers provides API without authentication for internal access. A local attacker can bypass authenti…
    CVE-2024-27167 (CVSS 7.4) — Toshiba printers use Sendmail to send emails to recipients. Sendmail is used with several insecure directories…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High