Toshiba Tec e-STudio MFP Security Advisory: Auth Bypass & Info Disclosure (CVE-2026-60011, CVE-2026-63545, CVE-2026-63563)

Vulnerability Overview Toshiba Tec Corporation has issued a response regarding security vulnerabilities present in certain products within its digital multifunction peripherals. These vulnerabilities pose a risk of information leakage. Scope of Impact Target Products: - e-STUDIO 908/1058/1208 - e-STUDIO 907/1057/1207 - These products are sold exclusively in the North American market. Specific Vulnerabilities: - CVE-2026-60011: User authentication can be bypassed via crafted URLs. - CVE-2026-63545: Incomplete cleanup of cache files. - CVE-2026-63563: User authentication is disabled by default during initial configuration in certain markets, allowing features such as address book editing and document submission to be accessed without user authentication. Remediation Countermeasure: - For CVE-2026-60011 and CVE-2026-63545, it is recommended to contact your service provider to update the main unit software. - For CVE-2026-63563, restrict access to the device’s web page using a password. Mitigation Measures: - Change the default administrator and user passwords and manage them appropriately. - Do not connect the multifunction peripheral directly to the internet; connect it through a firewall or similar network device. - Restrict access to the device’s web page using a password (navigate to [System Settings] > [Security Settings] > [Restrict Access to Device Web Page with Password]). - Regularly monitor the multifunction peripheral using the audit log feature to detect suspicious access. Acknowledgments CVE-2026-60011 and CVE-2026-63563 were reported by Mohamed Abdelaty of Cyber 50 Defense. CVE-2026-63563 was reported by John Jackson. Information Archive For more information, please visit the Information Archives. Additional Information Release Date: July 31, 2026 Company: Toshiba Tec Corporation Footer Information Privacy Policy: Privacy Policy Terms and Conditions: Terms and Conditions Copyright: © 1999-2026 Toshiba Tec Corporation. All Rights Reserved. LinkedIn Icon LinkedIn Creating with You Toshiba Tec Group Philosophy: Creating with You Navigation Bar Home Products Solutions Services Download & Videos Corporate Data Search Box Search Language Selection Worldwide Japanese Sitemap Contact Us Disclaimer Failure to implement the above countermeasures will increase the risk of the vulnerability being exploited. Summary Toshiba Tec Corporation has provided detailed information on security vulnerabilities within its digital multifunction peripherals, along with corresponding remediation and mitigation measures. Users are advised to take appropriate actions to ensure device security.

Goal Reached Thanks to every supporter — we hit 100%!

Toshiba Tec e-STudio MFP Security Advisory: Auth Bypass & Info Disclosure (CVE-2026-60011, CVE-2026-63545, CVE-2026-63563)