PT-2019-9404 · Xerox · Xerox C8030/C8035+3

Published 2019-01-03 · Updated 2019-10-03 · CVE-2018-17172

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xerox AltaLink B80xx versions prior to 100.008.028.05200 Xerox C8030/C8035 versions prior to 100.001.028.05200 Xerox C8045/C8055 versions prior to 100.002.028.05200 Xerox C8070 versions prior to 100.003.028.05200

Description The issue allows unauthenticated command injection in the web application.

Recommendations For Xerox AltaLink B80xx versions prior to 100.008.028.05200, update to version 100.008.028.05200 or later. For Xerox C8030/C8035 versions prior to 100.001.028.05200, update to version 100.001.028.05200 or later. For Xerox C8045/C8055 versions prior to 100.002.028.05200, update to version 100.002.028.05200 or later. For Xerox C8070 versions prior to 100.003.028.05200, update to version 100.003.028.05200 or later.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2018-17172

Affected Products

Xerox Altalink B80Xx

Xerox C8030/C8035

Xerox C8045/C8055

Xerox C8070

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-17172 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17172 · Vendor Advisory
• https://securitydocs.business.xerox.com/wp-content/uploads/2018/12/cert_Security_Mini_Bulletin_XRX18AL_for_ALB80xx-C80xx_v1.1.pdf · Vendor Advisory