PT-2020-9375 · Xerox · Xerox Printers

Published 2020-03-13 · Updated 2020-08-24 · CVE-2019-13166

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Xerox printers (affected versions not specified)

Description: The issue concerns the lack of account lockout implementation in some Xerox printers, allowing local account credentials to be extracted via brute force guessing attacks.

Recommendations: For affected Xerox printer models, consider implementing account lockout policies to prevent brute force guessing attacks. As a temporary workaround, restrict access to the device to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2019-13166

Affected Products

Xerox Printers

References · 4

• https://osv.dev/vulnerability/CVE-2019-13166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-13166 · Security Note
• https://security.business.xerox.com · Vendor Advisory
• https://nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabilities-in-xerox-printers · Note