Remote Device Vulnerability in Xerox VersaLink Firmware
CVE-2022-23968

7.5HIGH

Key Information:

Vendor

Xerox
Status
Versalink Firmware
Vendor
CVE Published:
26 January 2022

What is CVE-2022-23968?

Xerox VersaLink devices running specific versions of firmware prior to January 26, 2022, are susceptible to a vulnerability that enables remote attackers to cause a permanent denial of service. By exploiting a crafted TIFF file sent via an unauthenticated HTTP POST request, the devices can enter a boot loop due to faulty image parsing after a reboot. Although field technicians can resolve the issue, affected firmware versions including xx.42.01 and xx.50.61 are at risk. A recent vendor statement clarifies that newer firmware versions are not vulnerable.

References

https://neosmart.net/blog/2022/xerox-vulnerability-allows...
x_refsource_MISC
https://twitter.com/mqudsi/status/1485756915187695618
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.