CVE-2019-13166

Published: Mar 13, 2020Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks.

Affected (1)

Products: Xerox: Phaser 3320 Firmware

Xerox

1 product

Phaser 3320 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Xerox Phaser 3320 Firmware	Version v53.006.16.000

Running on/with	Platform Versions
Xerox Phaser 3320	All versions

Related CWEs

CWE-307

Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.

References (4)

https://security.business.xerox.com/

Source: cve@mitre.org

Vendor Advisory

https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/

Source: cve@mitre.org

Third Party Advisory

https://security.business.xerox.com/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.