description: Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
problem types: CWE-78 OS Command Injection
affected:
{
product: AltaLink B8045/B8055/B8065/B8075/B8090
vendor: XEROX
versions:
lessThanOrEqual: 101.008.008.27400, status: unknown, version: unspecified, versionType: custom
}
{
product: AltaLink C8030/C8035/C8045/C8055/C8070
vendor: XEROX
versions:
lessThanOrEqual: 101.001.008.27400, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 3655
vendor: XEROX
versions:
lessThanOrEqual: 073.060.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 5845/5855/5865/5875/5890
vendor: XEROX
versions:
lessThanOrEqual: 073.190.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 5945/5955
vendor: XEROX
versions:
lessThanOrEqual: 073.091.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 6655
vendor: XEROX
versions:
lessThanOrEqual: 073.110.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 7220/7225
vendor: XEROX
versions:
lessThanOrEqual: 073.030.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 7830/7835/7845/7855
vendor: XEROX
versions:
lessThanOrEqual: 073.010.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 7970
vendor: XEROX
versions:
lessThanOrEqual: 073.200.075.34540, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre EC7836/EC7856
vendor: XEROX
versions:
lessThanOrEqual: 073.020.167.17200, status: unknown, version: unspecified, versionType: custom
}
{
product: ColorQube 9301/9302/9303
vendor: XEROX
versions:
lessThan: 072.xxx.009.07200, status: affected, version: unspecified, versionType: custom
}
{
product: ColorQube 8700/8900
vendor: XEROX
versions:
lessThan: 072.xxx.009.07200, status: affected, version: unspecified, versionType: custom
}
{
product: WorkCentre 6400
vendor: XEROX
versions:
lessThanOrEqual: 061.070.100.24201, status: unknown, version: unspecified, versionType: custom
}
{
product: Phaser 6700
vendor: XEROX
versions:
lessThanOrEqual: 081.140.103.22600, status: unknown, version: unspecified, versionType: custom
}
{
product: Phaser 7800
vendor: XEROX
versions:
lessThanOrEqual: 081.150.103.05600, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 5735/5740/5745/5755/5765/5775/5790
vendor: XEROX
versions:
lessThanOrEqual: 061.132.221.21403, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 7525/7530/7535/7545/7556
vendor: XEROX
versions:
lessThanOrEqual: 061.121.224.18803, status: unknown, version: unspecified, versionType: custom
}
{
product: WorkCentre 7755/7765/7775
vendor: XEROX
versions:
lessThanOrEqual: 061.090.220.19700, status: unknown, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.0
]
solutions: A fix for some models is available.
workarounds: There are no known workarounds for now available.