Description
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XEROX | AltaLink B8045/B8055/B8065/B8075/B8090 | — | — |
| XEROX | AltaLink C8030/C8035/C8045/C8055/C8070 | — | — |
| XEROX | WorkCentre 3655 | — | — |
| XEROX | WorkCentre 5845/5855/5865/5875/5890 | — | — |
| XEROX | WorkCentre 5945/5955 | — | — |
| XEROX | WorkCentre 6655 | — | — |
| XEROX | WorkCentre 7220/7225 | — | — |
| XEROX | WorkCentre 7830/7835/7845/7855 | — | — |
| XEROX | WorkCentre 7970 | — | — |
| XEROX | WorkCentre EC7836/EC7856 | — | — |
| XEROX | ColorQube 9301/9302/9303 | unspecified – < 072.xxx.009.07200 | 072.xxx.009.07200 |
| XEROX | ColorQube 8700/8900 | unspecified – < 072.xxx.009.07200 | 072.xxx.009.07200 |
| XEROX | WorkCentre 6400 | — | — |
| XEROX | Phaser 6700 | — | — |
| XEROX | Phaser 7800 | — | — |
| XEROX | WorkCentre 5735/5740/5745/5755/5765/5775/5790 | — | — |
| XEROX | WorkCentre 7525/7530/7535/7545/7556 | — | — |
| XEROX | WorkCentre 7755/7765/7775 | — | — |