Toshiba e-STUDIO Printer Vulnerabilities Advisory (CVE-2024-51977, CVE-2024-51978, etc.)

From this webpage screenshot, the following key information about the vulnerability can be obtained: Vulnerability Details Target Product: e-STUDIO 301DN/302DNF (sold only in the Chinese market) Vulnerability List: - CVE-2017-9765: Stack Buffer Overflow Vulnerability - CVE-2024-2169: Infinite loop of messages between servers - CVE-2024-51977: Possibility of information leakage in the printer - CVE-2024-51978: Possibility of authentication bypass - CVE-2024-51980: Possibility of being forced to connect to TCP - CVE-2024-51981: Possibility of arbitrary HTTP request execution - CVE-2024-51983: External attacks can cause your device to crash - CVE-2024-51984: Possibility of information leakage in the printer due to passback attacks Solution Update Software: Contact the service provider to update the main unit software. Temporary Mitigation Measures Firewall Protection: Ensure the printer is used within a firewall-protected network environment in the office, or use a router at home. Change Settings: - Disable WSD function (CVE-2017-9765, CVE-2024-51980, CVE-2024-51981, CVE-2024-51983) - Disable TFTP (CVE-2024-2169) - Disable “Web browser settings” (CVE-2024-51977) - Change administrator password (CVE-2024-51978, CVE-2024-51984) Acknowledgments Thank you to Yepeng Pan from CISPA, Germany, for reporting the CVE-2024-2169 vulnerability. Thank you to Stephen Fewer, Chief Security Researcher at Rapid7, USA, for reporting vulnerabilities CVE-2024-51977 through CVE-2024-51984.

Goal Reached Thanks to every supporter — we hit 100%!

Toshiba e-STUDIO Printer Vulnerabilities Advisory (CVE-2024-51977, CVE-2024-51978, etc.)