Remote Device Vulnerability in Xerox VersaLink Firmware

CVE-2022-23968

Summary

Xerox VersaLink devices running specific versions of firmware prior to January 26, 2022, are susceptible to a vulnerability that enables remote attackers to cause a permanent denial of service. By exploiting a crafted TIFF file sent via an unauthenticated HTTP POST request, the devices can enter a boot loop due to faulty image parsing after a reboot. Although field technicians can resolve the issue, affected firmware versions including xx.42.01 and xx.50.61 are at risk. A recent vendor statement clarifies that newer firmware versions are not vulnerable.

References