CVE-2016-11061

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Apr 29, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-110625.3An issue was discovered in Mattermost Server before 3.5.1. E-mail address verification can be bypassed.CVE-2016-110636.1An issue was discovered in Mattermost Server before 3.5.1. XSS can occur via file preview.CVE-2016-110649.8An issue was discovered in Mattermost Desktop App before 3.4.0. Strings could be executed as code via injection.CVE-2016-110654.3An issue was discovered in Mattermost Server before 3.3.0. An attacker could use the WebSocket feature to send pop-up messages to users or cCVE-2016-110667.5An issue was discovered in Mattermost Server before 3.2.0. The initial_load API disclosed unnecessary personal information.CVE-2016-110675.3An issue was discovered in Mattermost Server before 3.2.0. It allowed crafted posts that could cause a web browser to hang.CVE-2016-110685.3An issue was discovered in Mattermost Server before 3.2.0. Attackers could read LDAP fields via injection.CVE-2016-110697.5An issue was discovered in Mattermost Server before 3.2.0. It mishandles brute-force attempts at password change.CVE-2016-11077.5Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer CVE-2016-110705.4An issue was discovered in Mattermost Server before 3.1.0. It allows XSS via theme color-code values.CVE-2016-110716.1An issue was discovered in Mattermost Server before 3.1.0. It allows XSS because the noreferrer and noopener protection mechanisms were not CVE-2016-110726.5An issue was discovered in Mattermost Server before 3.0.2. The purposes of a session ID and a Session Token were mishandled.
CVE-2016-11061: Critical severity, CVSS 9.8 | Vulnix