CVE-2018-20768
Critical
Description
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file.
SeverityCritical
CVSS9.8
Exploit probability—
ProductXerox Workcentre 3655i Firmware
PublishedFeb 10, 2019
First seenFeb 10, 2019
How to fix
Update
- xerox workcentre_3655i_firmware073.060.048.15000 or later
- xerox workcentre_3655_firmware073.060.048.15000 or later
- xerox workcentre_5890i_firmware073.190.048.15000 or later
- xerox workcentre_5865i_firmware073.190.048.15000 or later
- xerox workcentre_5875i_firmware073.190.048.15000 or later
- xerox workcentre_5845_firmware073.190.048.15000 or later
- xerox workcentre_5865_firmware073.190.048.15000 or later
- xerox workcentre_5875_firmware073.190.048.15000 or later
- xerox workcentre_5890_firmware073.190.048.15000 or later
- xerox workcentre_5900_firmware073.091.048.15000 or later
- xerox workcentre_5900i_firmware073.091.048.15000 or later
- xerox workcentre_6655_firmware073.110.048.15000 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| xerox workcentre_3655i_firmware | v < 073.060.048.15000 | 073.060.048.15000 |
| xerox workcentre_3655_firmware | v < 073.060.048.15000 | 073.060.048.15000 |
| xerox workcentre_5890i_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5865i_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5875i_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5845_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5865_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5875_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5890_firmware | v < 073.190.048.15000 | 073.190.048.15000 |
| xerox workcentre_5900_firmware | v < 073.091.048.15000 | 073.091.048.15000 |
| xerox workcentre_5900i_firmware | v < 073.091.048.15000 | 073.091.048.15000 |
| xerox workcentre_6655_firmware | v < 073.110.048.15000 | 073.110.048.15000 |
| xerox workcentre_6655i_firmware | v < 073.110.048.15000 | 073.110.048.15000 |
| xerox workcentre_7855_firmware | v < 073.040.048.15000 | 073.040.048.15000 |
| xerox workcentre_7225_firmware | v < 073.030.048.15000 | 073.030.048.15000 |
| xerox workcentre_7220_firmware | v < 073.030.048.15000 | 073.030.048.15000 |
| xerox workcentre_7220i_firmware | v < 073.030.048.15000 | 073.030.048.15000 |
| xerox workcentre_7225i_firmware | v < 073.030.048.15000 | 073.030.048.15000 |
| xerox workcentre_7855i_firmware | v < 073.040.048.15000 | 073.040.048.15000 |
| xerox workcentre_7845i_firmware | v < 073.040.048.15000 | 073.040.048.15000 |
| xerox workcentre_7835i_firmware | v < 073.010.048.15000 | 073.010.048.15000 |
| xerox workcentre_7830i_firmware | v < 073.010.048.15000 | 073.010.048.15000 |
| xerox workcentre_7830_firmware | v < 073.010.048.15000 | 073.010.048.15000 |
| xerox workcentre_7835_firmware | v < 073.010.048.15000 | 073.010.048.15000 |
| xerox workcentre_7845_firmware | v < 073.040.048.15000 | 073.040.048.15000 |
| xerox workcentre_7970_firmware | v < 073.200.048.15000 | 073.200.048.15000 |
| xerox workcentre_7970i_firmware | v < 073.200.048.15000 | 073.200.048.15000 |
| xerox workcentre_ec7836_firmware | v < 073.050.048.15000 | 073.050.048.15000 |
| xerox workcentre_ec7856_firmware | v < 073.020.048.15000 | 073.020.048.15000 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.