CVE-2024-27141
Toshiba printers use XML communication for the API endpoint provided by the printer. For the endpoint, XML parsing library is used and it is vulnerable to a time-based blind XML External Entity (XXE) vulnerability. An attacker can DoS the printers by sending a HTTP request without authentication. An attacker can exploit the XXE to retrieve information. As for the affected products/models/versions, see the reference URL.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.9
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 1.11%
- CWE
- CWE-776
- Published
- 2024-06-14
- Last modified
- 2026-03-13
Affected products
- Toshiba Tec Corporation Toshiba Tec e-Studio multi-function peripheral (MFP)
Weakness type
Related vulnerabilities
- CVE-2026-58234 — Denial of Service vulnerability in SAP Process Integration (SOAP Adapter)
- CVE-2026-16180 — IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs
- CVE-2026-78681 — NLTK before 3.10.3 Entity Expansion DoS via ElementTree
- CVE-2026-73569 — fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
- CVE-2026-3415 — XML External Entity (XXE) Injection via Schema Validation in Multiple WSO2 Products Allows File Reading and Denial of Service
- CVE-2026-14865 — XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX
- CVE-2026-14979 — IBM Engineering Lifecycle Management - Jazz Foundation is vulnerable to XML Entity Expansion attack
- CVE-2026-45304 — Symfony: YAML Parser Exponential Memory Allocation via Recursive Collection-Alias Expansion ("Billion Laughs")