CVE-2024-6333

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
Xerox	AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 \| C8030 / C8035 / C8045 / C8055 / C807	103.xxx.024.18600
Xerox	Xerox® EC8036 / EC8056	103.xxx.024.18600
Xerox	Xerox® EC8036 / EC8056 - Common Criteria (June 2022)	103.023.031.35105
Xerox	Xerox® EC8036 / EC8056 - Common Criteria (June 2024)	103.xxx.013.14115
Xerox	AltaLink®C8130 / C8135 / C8145 / C8155 / C8170 \| B8145 / B8155 / B8170 Common Criteria (Aug 2024)	119.xxx.023.13006
Xerox	AltaLink® C8130 / C8135 / C8145 / C8155 / C8170 \| B8145 / B8155 / B8170 Common Criteria Certified (Aug 2023)	111.xxx.003.11600
Xerox	VersaLink® B625 / C625 \| B425 / C425 Common Criteria Certified (2024)	119.xxx.003.11705
Xerox	WorkCentre 3655/3655i	075.060.004.07810
Xerox	WorkCentre 5945/55i	075.091.004.07810
Xerox	WorkCentre 6655/6655i	075.110.004.07810
Xerox	WorkCentre 7220/7225i	075.030.004.07810
Xerox	WorkCentre 7830/7835i	075.010 004.07810
Xerox	WorkCentre 7845/7855i	075.040.004.07810
Xerox	WorkCentre 7845/7855 (IBG)	075.080.004.07810
Xerox	WorkCentre 7970/7970i	075.200.004.07810
Xerox	WorkCentre EC7836	075.050.004.07810
Xerox	WorkCentre EC7856	075.020.004.07810
xerox	altalink_firmware	< 103.xxx.024.18600; < 119.xxx.023.13006; < 111.xxx.003.11600
xerox	versalink_firmware	< 119.xxx.003.11705
xerox	workcentre_firmware	< 075.060.004.07810; < 075.091.004.07810; < 075.110.004.07810; < 075.030.004.07810; < 075.010 004.07810; < 075.040.004.07810; < 075.080.004.07810; < 075.200.004.07810; < 075.050.004.07810; < 075.020.004.07810
xerox	xerox_firmware	< 103.xxx.024.18600; < 103.023.031.35105; < 103.xxx.013.14115

References

Timeline

Published: Oct 17, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-63346.1The Easy Table of Contents WordPress plugin before 2.0.67.1 does not sanitise and escape some of its settings, which could allow high privil CVE-2024-63354.8The Tracking Code Manager WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow high privilege CVE-2024-63365.3A Security Misconfiguration vulnerability in GitHub Enterprise Server allowed sensitive information disclosure to unauthorized users in GitH CVE-2024-63376.5An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pu CVE-2024-63388.8The FV Flowplayer Video Player plugin for WordPress is vulnerable to time-based SQL Injection via the ‘exclude’ parameter in all versions up CVE-2024-63396.1The Phlox PRO theme for WordPress is vulnerable to Reflected Cross-Site Scripting via search parameters in all versions up to, and including CVE-2024-63405.4The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all CVE-2024-63429.8**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AA CVE-2024-63434.9A buffer overflow vulnerability in the CGI program of Zyxel ATP series firmware versions from V4.32 through V5.38, USG FLEX series firmware CVE-2024-63442.4A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the CVE-2024-63458.8A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download funct CVE-2024-63465.4The Gutenberg Blocks, Page Builder – ComboBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the redirectURL param