It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.

It appears that some hardcoded keys are used for authentication to internal API. Knowing these private keys may allow attackers to bypass authentication and reach administrative interfaces. As for the affected products/models/versions, see the reference URL.

MFPs (multifunction printers) provided by Toshiba Tec Corporation and Oki Electric Industry Co., Ltd. contain multiple vulnerabilities listed below. <ul> <li><b>Improper Restriction of Recursive Entity References in DTDs (&#39;XML Entity Expansion&#39;) (<a href="https://cwe.mitre.org/data/definitions/776">CWE-776</a>) </b>- CVE-2024-27141, CVE-2024-27142</li> <li><b>Execution with Unnecessary Privileges (<a href="https://cwe.mitre.org/data/definitions/250">CWE-250</a>) </b>- CVE-2024-27143, CVE-2024-27146, CVE-2024-27147, CVE-2024-3498</li> <li><b>Incorrect Default Permissions (<a href="https://cwe.mitre.org/data/definitions/276">CWE-276</a>) </b>- CVE-2024-27148, CVE-2024-27149, CVE-2024-27150, CVE-2024-27151, CVE-2024-27152, CVE-2024-27153, CVE-2024-27155, CVE-2024-27167, CVE-2024-27171</li> <li><b>Path Traversal (<a href="https://cwe.mitre.org/data/definitions/22">CWE-22</a>) </b>- CVE-2024-27144, CVE-2024-27145, CVE-2024-27173, CVE-2024-27174, CVE-2024-27176, CVE-2024-27177, CVE-2024-27178</li> <li><b>Insertion of Sensitive Information into Log File (<a href="https://cwe.mitre.org/data/definitions/532">CWE-532</a>) </b>- CVE-2024-27154, CVE-2024-27156, CVE-2024-27157</li> <li><b>Plaintext Storage of a Password (<a href="https://cwe.mitre.org/data/definitions/256">CWE-256</a>) </b>- CVE-2024-27166</li> <li><b>Debug Messages Revealing Unnecessary Information (<a href="https://cwe.mitre.org/data/definitions/1295">CWE-1295</a>) </b>- CVE-2024-27179</li> <li…