Multiple Toshiba e-Studio Devices Security Bypass Vulnerability

Bugtraq ID:	50168
Class:	Input Validation Error
CVE:	CVE-2012-1239
Remote:	Yes
Local:	No
Published:	Oct 17 2011 12:00AM
Updated:	Apr 05 2012 08:30PM
Credit:	Deral Heiland PercX
Vulnerable:	Toshiba e-STUDIO855 0 Toshiba e-STUDIO755 0 Toshiba e-STUDIO655 0 Toshiba e-STUDIO555 0 Toshiba e-STUDIO455 0 Toshiba e-STUDIO355 0 Toshiba e-STUDIO305 0 Toshiba e-STUDIO255 0 Toshiba e-STUDIO182 0
Not Vulnerable:

Multiple Toshiba e-Studio Devices Security Bypass Vulnerability

Multiple Toshiba e-Studio devices are prone to a security-bypass vulnerability.

Successful exploits will allow attackers to bypass certain security restrictions and gain access in the context of the device.

Multiple Toshiba e-Studio Devices Security Bypass Vulnerability

Attackers can use a browser to exploit this issue.

The following example URI is available:

http://www.example.com/TopAccess//Administrator/Setup/ScanToFile/List.htm

Multiple Toshiba e-Studio Devices Security Bypass Vulnerability

Solution:
Updates are available; please see the references for more information.

Multiple Toshiba e-Studio Devices Security Bypass Vulnerability

References:

• Toshiba e-Studio Homepage (Toshiba)
  
• TOSHIBA TEC e-Studio series vulnerable to authentication bypass (JPCERT/CC and IPA)
  
• TOSHIBA TEC e-Studio series vulnerable to authentication bypass (IPA)