CVE-2024-3498: Incorrect Permission Assignment Privilege Escalation Vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-06-14 · updated 2026-06-17
Weakness: CWE-250

Description

Attackers can then execute malicious files by enabling certain services of the printer via the web configuration page and elevate its privileges to root. As for the affected products/models/versions, see the reference URL.

Affected products

Toshibatec E-Studio-2010-Ac: all versions
Toshibatec E-Studio-2015-Nc: all versions
Toshibatec E-Studio-2020 Ac: all versions
Toshibatec E-Studio-2021 Ac: all versions
Toshibatec E-Studio-2110-Ac: all versions
Toshibatec E-Studio-2510-Ac: all versions
Toshibatec E-Studio-2515-Nc: all versions
Toshibatec E-Studio-2520 Nc: all versions
Toshibatec E-Studio-2521 Ac: all versions
Toshibatec E-Studio-2525 Ac: all versions
Toshibatec E-Studio-2528-A: all versions
Toshibatec E-Studio-2610-Ac: all versions
Toshibatec E-Studio-2615-Nc: all versions
Toshibatec E-Studio-3015-Nc: all versions
Toshibatec E-Studio-3025 Ac: all versions
Toshibatec E-Studio-3028-A: all versions
Toshibatec E-Studio-3115-Nc: all versions
Toshibatec E-Studio-330-Ac: all versions
Toshibatec E-Studio-3515-Nc: all versions
Toshibatec E-Studio-3525 Ac: all versions
Toshibatec E-Studio-3525 Acg: all versions
Toshibatec E-Studio-3528-A: all versions
Toshibatec E-Studio-3528-Ag: all versions
Toshibatec E-Studio-3615-Nc: all versions
Toshibatec E-Studio-400-Ac: all versions
Toshibatec E-Studio-4525 Ac: all versions
Toshibatec E-Studio-4528-A: all versions
Toshibatec E-Studio-4528-Ag: all versions
Toshibatec E-Studio-5525 Ac: all versions
Toshibatec E-Studio-5525 Acg: all versions

References

Get alerted when CVE-2024-3498 or the next vulnerability affects your stack