CVE-2018-17172
Critical
Description
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.
SeverityCritical
CVSS9.8
Exploit probability—
ProductXerox Altalink C8030 Firmware
PublishedJan 3, 2019
First seenJan 3, 2019
How to fix
Update
- xerox altalink_c8030_firmware100.001.028.05200 or later
- xerox altalink_c8035_firmware100.001.028.05200 or later
- xerox altalink_c8045_firmware100.002.028.05200 or later
- xerox altalink_c8055_firmware100.002.028.05200 or later
- xerox altalink_c8070_firmware100.003.028.05200 or later
- xerox altalink_b8045_firmware100.008.028.05200 or later
- xerox altalink_b8055_firmware100.008.028.05200 or later
- xerox altalink_b8065_firmware100.008.028.05200 or later
- xerox altalink_b8075_firmware100.008.028.05200 or later
- xerox altalink_b8090_firmware100.008.028.05200 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xerox altalink_c8030_firmware | v < 100.001.028.05200 | 100.001.028.05200 |
| xerox altalink_c8035_firmware | v < 100.001.028.05200 | 100.001.028.05200 |
| xerox altalink_c8045_firmware | v < 100.002.028.05200 | 100.002.028.05200 |
| xerox altalink_c8055_firmware | v < 100.002.028.05200 | 100.002.028.05200 |
| xerox altalink_c8070_firmware | v < 100.003.028.05200 | 100.003.028.05200 |
| xerox altalink_b8045_firmware | v < 100.008.028.05200 | 100.008.028.05200 |
| xerox altalink_b8055_firmware | v < 100.008.028.05200 | 100.008.028.05200 |
| xerox altalink_b8065_firmware | v < 100.008.028.05200 | 100.008.028.05200 |
| xerox altalink_b8075_firmware | v < 100.008.028.05200 | 100.008.028.05200 |
| xerox altalink_b8090_firmware | v < 100.008.028.05200 | 100.008.028.05200 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.