CVE-2024-3498

Incorrect Permission Assignment Privilege Escalation Vulnerability

Published Jun 14, 2024 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Description
Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.

Analysis

No analysis available yet

Remediation

Vendor Solution

This issue is fixed in the version released on June 14, 2024 and all later versions.


Vendor Workaround

When connecting the MFPs and printers with an outer network such as the Internet, only operate it in a network environment protected by a firewall, etc. to prevent information from being leaked due to incorrect settings or avoid illegal access by unauthorized users.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2024-32084 Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.
History

No history.

Subscriptions

No data.

Weaknesses
  • CWE-250

    Execution with Unnecessary Privileges

Sources

Status
PUBLISHED
Assigner
Toshiba
Published
Updated
Aug 1, 2024, 8:12 PM
Reserved
Apr 9, 2024, 12:59 AM
Status
Deferred
Published
Jun 14, 2024, 5:15 AM
Modified
Jun 17, 2026, 7:44 AM