OS Command Injection in Xerox Products
CVE-2019-10880

9.8CRITICAL

Key Information:

Vendor

Xerox
Status
Altalink B8045/b8055/b8065/b8075/b8090
Altalink C8030/c8035/c8045/c8055/c8070
Workcentre 3655
Workcentre 5845/5855/5865/5875/5890
Vendor
CVE Published:
12 April 2019

What is CVE-2019-10880?

A vulnerability exists within multiple Xerox products that allows an unauthenticated attacker to execute arbitrary commands on the underlying Linux system as the 'nobody' user. This can be triggered through a specially crafted HTTP request, exposing the device to potential unauthorized access and manipulation. The risk varies based on specific configurations, where some may not require authentication for exploitation. This underscores the importance of securing devices against such vulnerabilities and implementing robust access controls.

Affected Version(s)

AltaLink B8045/B8055/B8065/B8075/B8090 <= 101.008.008.27400

AltaLink C8030/C8035/C8045/C8055/C8070 <= 101.001.008.27400

ColorQube 8700/8900 < 072.xxx.009.07200

References

https://airbus-seclab.github.io/
x_refsource_MISC
https://securitydocs.business.xerox.com/wp-content/upload...
x_refsource_CONFIRM

EPSS Score

5% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Raphaël Rigo from the Airbus Security Lab
.