GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-27175 (GCVE-0-2024-27175)

Vulnerability from cvelistv5 – Published: 2024-06-14 04:04 – Updated: 2025-02-13 17:46
VLAI
Title
Local File Inclusion
Summary
Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL.
Severity
4.4 (Medium)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-14 16:39 UTC
CWE
  • CWE-73 - External Control of File Name or Path
Assigner
References
Impacted products
Date Public
2024-06-14 02:00
Credits
We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-27175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T16:39:09.228413Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-30T14:25:44.754Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:27:59.630Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Linux"
          ],
          "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "see the reference URL"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
        }
      ],
      "datePublic": "2024-06-14T02:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
            }
          ],
          "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
            }
          ],
          "value": "We are not aware of any malicious exploitation by these vulnerabilities."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-251",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-251 Local Code Inclusion"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-73",
              "description": "CWE-73 External Control of File Name or Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T05:07:14.715Z",
        "orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "shortName": "Toshiba"
      },
      "references": [
        {
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
            }
          ],
          "value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-06-14T02:00:00.000Z",
          "value": "Fixes will be released"
        }
      ],
      "title": "Local File Inclusion",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
            }
          ],
          "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
    "assignerShortName": "Toshiba",
    "cveId": "CVE-2024-27175",
    "datePublished": "2024-06-14T04:04:32.574Z",
    "dateReserved": "2024-02-21T02:12:01.820Z",
    "dateUpdated": "2025-02-13T17:46:15.100Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-27175",
      "date": "2026-09-17",
      "epss": "0.00851",
      "percentile": "0.56505"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
        },
        {
          "lang": "es",
          "value": "El programa Remote Command permite a un atacante leer cualquier archivo utilizando una vulnerabilidad de inclusi\u00f3n de archivos locales. Un atacante puede leer cualquier archivo de la impresora. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."
        }
      ],
      "id": "CVE-2024-27175",
      "lastModified": "2024-11-21T09:04:01.517",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 0.7,
            "impactScore": 3.6,
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "type": "Secondary"
          }
        ]
      },
      "published": "2024-06-14T04:15:37.280",
      "references": [
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.toshibatec.com/information/20240531_01.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
        }
      ],
      "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-73"
            }
          ],
          "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
          "type": "Secondary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Linux"
                ],
                "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
                "vendor": "Toshiba Tec Corporation",
                "versions": [
                  {
                    "status": "affected",
                    "version": "see the reference URL"
                  }
                ]
              }
            ],
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
          },
          {
            "lang": "es",
            "value": "El programa Remote Command permite a un atacante leer cualquier archivo utilizando una vulnerabilidad de inclusi\u00f3n de archivos locales. Un atacante puede leer cualquier archivo de la impresora. En cuanto a los productos/modelos/versiones afectados, consulte la URL de referencia."
          }
        ],
        "id": "CVE-2024-27175",
        "lastModified": "2026-06-17T07:19:21.567",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 0.7,
              "impactScore": 3.6,
              "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-27175",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-14T16:39:09.228413Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-06-14T04:15:37.280",
        "references": [
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.toshibatec.com/information/20240531_01.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
          }
        ],
        "sourceIdentifier": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-73"
              }
            ],
            "source": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T20:30:46+00:00",
      "cve": "CVE-2024-27175",
      "id": "CVE-2024-27175",
      "initial_release_date": "2024-06-14T02:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Local File Inclusion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-27175.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T00:27:59.630Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.toshibatec.com/information/20240531_01.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-27175",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-06-14T16:39:09.228413Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-06-14T16:39:17.246Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Linux"
              ],
              "product": "Toshiba Tec e-Studio multi-function peripheral (MFP)",
              "vendor": "Toshiba Tec Corporation",
              "versions": [
                {
                  "status": "affected",
                  "version": "see the reference URL"
                }
              ]
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "We expresses its gratitude to Pierre Barre for reporting relevant security vulnerabilities for our products."
            }
          ],
          "datePublic": "2024-06-14T02:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
                }
              ],
              "value": "Remote Command program allows an attacker to read any file using a Local File Inclusion vulnerability. An attacker can read any file on the printer. As for the affected products/models/versions, see the reference URL."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "We are not aware of any malicious exploitation by these vulnerabilities.\u003cbr\u003e"
                }
              ],
              "value": "We are not aware of any malicious exploitation by these vulnerabilities."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-251",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-251 Local Code Inclusion"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 4.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-73",
                  "description": "CWE-73 External Control of File Name or Path",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2024-07-04T05:07:14.715Z",
            "orgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
            "shortName": "Toshiba"
          },
          "references": [
            {
              "url": "https://www.toshibatec.com/information/20240531_01.html"
            },
            {
              "url": "https://www.toshibatec.com/information/pdf/information20240531_01.pdf"
            },
            {
              "url": "https://jvn.jp/en/vu/JVNVU97136265/index.html"
            },
            {
              "url": "http://seclists.org/fulldisclosure/2024/Jul/1"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "This issue is fixed in the version released on June 14, 2024 and all later versions.\u003cbr\u003e"
                }
              ],
              "value": "This issue is fixed in the version released on June 14, 2024 and all later versions."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2024-06-14T02:00:00.000Z",
              "value": "Fixes will be released"
            }
          ],
          "title": "Local File Inclusion",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.\u003cbr\u003e"
                }
              ],
              "value": "When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "ecc0f906-8666-484c-bcf8-c3b7520a72f0",
        "assignerShortName": "Toshiba",
        "cveId": "CVE-2024-27175",
        "datePublished": "2024-06-14T04:04:32.574Z",
        "dateReserved": "2024-02-21T02:12:01.820Z",
        "dateUpdated": "2025-02-13T17:46:15.100Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.