CVE-2016-11061

Published: Apr 29, 2020Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

Affected (25)

Xerox

25 products

Workcentre 3655 Firmware

Workcentre 3655i Firmware

Workcentre 5865 Firmware

Workcentre 5875 Firmware

Workcentre 5890 Firmware

Workcentre 5865i Firmware

Workcentre 5875i Firmware

Workcentre 5890i Firmware

Workcentre 5945 Firmware

Workcentre 5955 Firmware

Workcentre 5945i Firmware

Workcentre 5955i Firmware

Workcentre 6655 Firmware

Workcentre 6655i Firmware

Workcentre 7200 Firmware

Workcentre 7200i Firmware

Workcentre 7225i Firmware

Workcentre 7830 Firmware

Workcentre 7835 Firmware

Workcentre 7845 Firmware

Workcentre 7855 Firmware

Workcentre 7970 Firmware

Workcentre 7970i Firmware

Workcentre 7225 Firmware

Workcentre 7220 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 3655 Firmware	Before 073.060.086.15410

Running on/with	Platform Versions
Xerox Workcentre 3655	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 3655i Firmware	Before 073.060.086.15410

Running on/with	Platform Versions
Xerox Workcentre 3655i	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5865 Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5865	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5875 Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5875	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5890 Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5890	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5865i Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5865i	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5875i Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5875i	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5890i Firmware	Before 073.190.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5890i	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5945 Firmware	Before 073.091.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5945	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5955 Firmware	Before 073.091.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5955	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5945i Firmware	Before 073.091.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5945i	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 5955i Firmware	Before 073.091.086.15410

Running on/with	Platform Versions
Xerox Workcentre 5955i	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 6655 Firmware	Before 073.110.086.15410

Running on/with	Platform Versions
Xerox Workcentre 6655	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 6655i Firmware	Before 073.110.086.15410

Running on/with	Platform Versions
Xerox Workcentre 6655i	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7200 Firmware	Before 073.030.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7200	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7200i Firmware	Before 073.030.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7200i	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7225i Firmware	Before 073.030.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7225i	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7830 Firmware	Before 073.010.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7830	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7835 Firmware	Before 073.010.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7835	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7845 Firmware	Before 073.010.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7845	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7855 Firmware	Before 073.010.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7855	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7970 Firmware	Before 073.200.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7970	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7970i Firmware	Before 073.200.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7970i	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7225 Firmware	Before 073.030.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7225	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Workcentre 7220 Firmware	Before 073.030.086.15410

Running on/with	Platform Versions
Xerox Workcentre 7220	All versions

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (2)

https://securitydocs.business.xerox.com/wp-content/uploads/2016/10/cert_Mini_Security_Bulletin_XRX16Q_for_ConnectKey_R16-05_v1-1-2.pdf

Source: cve@mitre.org

Vendor Advisory

https://securitydocs.business.xerox.com/wp-content/uploads/2016/10/cert_Mini_Security_Bulletin_XRX16Q_for_ConnectKey_R16-05_v1-1-2.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.