PT-2022-16373 · Xerox · Xerox Versalink

Mahmoud Al-Qudsi · Published 2022-01-26 · Updated 2022-02-03 · CVE-2022-23968

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Xerox VersaLink devices versions xx.42.01 through xx.50.61 Xerox VersaLink devices versions prior to xx.61.23

Description The issue allows remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request, resulting in a permanent denial of service. This occurs because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes, creating a boot loop. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory.

Recommendations For Xerox VersaLink devices versions xx.42.01 through xx.50.61, consider disabling the image parsing function until a patch is available. For Xerox VersaLink devices versions prior to xx.61.23, restrict access to the device to prevent unauthenticated HTTP POST requests until a patch is available. As a temporary workaround, consider blocking unauthenticated access to the device in the settings to minimize the risk of exploitation.

Exploit

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2022-23968

Affected Products

Xerox Versalink

References · 8

• 🔥 https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers · Exploit
• https://osv.dev/vulnerability/CVE-2022-23968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-23968 · Security Note
• https://t.me/nekaspersky/1749 · Telegram Post
• https://t.me/sysadm_in_channel/3741 · Telegram Post
• https://t.me/cvenotify/25888 · Telegram Post
• https://twitter.com/mqudsi/status/1485756915187695618 · Note
• https://t.me/cvenotify/25832 · Telegram Post