CVE-2024-27171 Insecure permissions
A remote attacker can exploit insecure upload permissions to overwrite Python files and achieve remote code execution on Toshiba Tec MFPs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-27171?
CVE-2024-27171 is a high-severity vulnerability in Toshiba Tec e-Studio multi-function peripheral (MFP), published on 14 Jun 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A remote attacker using the insecure upload functionality will be able to overwrite any Python file and get Remote Code Execution. As for the affected products/models/versions, see the reference URL.
Weakness: CWE-276
Which versions are affected by CVE-2024-27171?
How do I fix CVE-2024-27171?
No fix has been published for CVE-2024-27171 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-27171 being exploited?
There is no known exploitation of CVE-2024-27171 in the wild and no public exploit code.
Sources
Also known as GHSA-v37p-fmrv-x297.