OS Command Injection in Xerox Products

CVE-2019-10880

Summary

A vulnerability exists within multiple Xerox products that allows an unauthenticated attacker to execute arbitrary commands on the underlying Linux system as the 'nobody' user. This can be triggered through a specially crafted HTTP request, exposing the device to potential unauthorized access and manipulation. The risk varies based on specific configurations, where some may not require authentication for exploitation. This underscores the importance of securing devices against such vulnerabilities and implementing robust access controls.

References