High severity · published Jun 14, 2024
CVE-2024-3498
Incorrect Permission Assignment Privilege Escalation Vulnerability
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
Affected product
TT
Toshiba Tec e-Studio multi-function peripheral (MFP)
Toshiba Tec Corporation
More from Toshiba Tec e-Studio multi-function peripheral (MFP)
9.8
CVE-2024-27174
insecure upload
9.8
CVE-2024-27173
insecure upload
9.8
CVE-2024-27172
Remote Code Execution
9.8
CVE-2024-27145
Multiple Post-authenticated Remote Code Execution
9.8
CVE-2024-27144
Pre-authenticated Remote Code Execution