CVE-2016-11061
Critical
Description
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
SeverityCritical
CVSS9.8
Exploit probability81. percentile2%
ProductXerox Workcentre 3655 Firmware
PublishedApr 29, 2020
First seenApr 29, 2020
How to fix
Update
- xerox workcentre_3655_firmware073.060.086.15410 or later
- xerox workcentre_3655i_firmware073.060.086.15410 or later
- xerox workcentre_5865_firmware073.190.086.15410 or later
- xerox workcentre_5875_firmware073.190.086.15410 or later
- xerox workcentre_5890_firmware073.190.086.15410 or later
- xerox workcentre_5865i_firmware073.190.086.15410 or later
- xerox workcentre_5875i_firmware073.190.086.15410 or later
- xerox workcentre_5890i_firmware073.190.086.15410 or later
- xerox workcentre_5945_firmware073.091.086.15410 or later
- xerox workcentre_5955_firmware073.091.086.15410 or later
- xerox workcentre_5945i_firmware073.091.086.15410 or later
- xerox workcentre_5955i_firmware073.091.086.15410 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xerox workcentre_3655_firmware | v < 073.060.086.15410 | 073.060.086.15410 |
| xerox workcentre_3655i_firmware | v < 073.060.086.15410 | 073.060.086.15410 |
| xerox workcentre_5865_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5875_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5890_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5865i_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5875i_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5890i_firmware | v < 073.190.086.15410 | 073.190.086.15410 |
| xerox workcentre_5945_firmware | v < 073.091.086.15410 | 073.091.086.15410 |
| xerox workcentre_5955_firmware | v < 073.091.086.15410 | 073.091.086.15410 |
| xerox workcentre_5945i_firmware | v < 073.091.086.15410 | 073.091.086.15410 |
| xerox workcentre_5955i_firmware | v < 073.091.086.15410 | 073.091.086.15410 |
| xerox workcentre_6655_firmware | v < 073.110.086.15410 | 073.110.086.15410 |
| xerox workcentre_6655i_firmware | v < 073.110.086.15410 | 073.110.086.15410 |
| xerox workcentre_7200_firmware | v < 073.030.086.15410 | 073.030.086.15410 |
| xerox workcentre_7200i_firmware | v < 073.030.086.15410 | 073.030.086.15410 |
| xerox workcentre_7225i_firmware | v < 073.030.086.15410 | 073.030.086.15410 |
| xerox workcentre_7830_firmware | v < 073.010.086.15410 | 073.010.086.15410 |
| xerox workcentre_7835_firmware | v < 073.010.086.15410 | 073.010.086.15410 |
| xerox workcentre_7845_firmware | v < 073.010.086.15410 | 073.010.086.15410 |
| xerox workcentre_7855_firmware | v < 073.010.086.15410 | 073.010.086.15410 |
| xerox workcentre_7970_firmware | v < 073.200.086.15410 | 073.200.086.15410 |
| xerox workcentre_7970i_firmware | v < 073.200.086.15410 | 073.200.086.15410 |
| xerox workcentre_7225_firmware | v < 073.030.086.15410 | 073.030.086.15410 |
| xerox workcentre_7220_firmware | v < 073.030.086.15410 | 073.030.086.15410 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.