A vulnerability, which was classified as problematic, has been found in Toshiba 4690 Operating System 6 Release 3 (Feedback Software). This issue affects some unknown functionality of the component TCP Service. The manipulation with an unknown input leads to a information disclosure vulnerability (Environment Variable). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

Toshiba 4690 Operating System 6 Release 3, when the ADXSITCF logical name is not properly restricted, allows remote attackers to read potentially sensitive system environment variables via a crafted request to TCP port 54138.

The weakness was shared 12/31/2015 (Website). The advisory is shared at kb.cert.org. The identification of this vulnerability is CVE-2014-4876 since 07/10/2014. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Addressing this vulnerability is possible by firewalling tcp/54138.

The entries VDB-80833, VDB-80834, VDB-81021 and VDB-81758 are related to this item.

Productinfo

Type

• Feedback Software

Vendor

• Toshiba

Name

• 4690 Operating System

Version

• 6 Release 3

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion