Description
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
Metrics
CVSS 3.0 9.8/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| XEROX | AltaLink B8045/B8055/B8065/B8075/B8090 | — |
| XEROX | AltaLink C8030/C8035/C8045/C8055/C8070 | — |
| XEROX | WorkCentre 3655 | — |
| XEROX | WorkCentre 5845/5855/5865/5875/5890 | — |
| XEROX | WorkCentre 5945/5955 | — |
| XEROX | WorkCentre 6655 | — |
| XEROX | WorkCentre 7220/7225 | — |
| XEROX | WorkCentre 7830/7835/7845/7855 | — |
| XEROX | WorkCentre 7970 | — |
| XEROX | WorkCentre EC7836/EC7856 | — |
| XEROX | ColorQube 9301/9302/9303 | >= unspecified, < 072.xxx.009.07200 |
| XEROX | ColorQube 8700/8900 | >= unspecified, < 072.xxx.009.07200 |
| XEROX | WorkCentre 6400 | — |
| XEROX | Phaser 6700 | — |
| XEROX | Phaser 7800 | — |
| XEROX | WorkCentre 5735/5740/5745/5755/5765/5775/5790 | — |
| XEROX | WorkCentre 7525/7530/7535/7545/7556 | — |
| XEROX | WorkCentre 7755/7765/7775 | — |
References
- https://airbus-seclab.github.io/Not Applicable
- https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdfVendor Advisory
- https://airbus-seclab.github.io/Not Applicable
- https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdfVendor Advisory
Timeline
- Published
- Apr 12, 2019
- Last modified
- Jun 17, 2026
- NVD status
- Modified