critical9.8
CVE-2019-10880
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS C…
Impact
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Xerox | Colorqube 8700 Firmware | before 072.161.009.07200 |
| Xerox | Colorqube 8900 Firmware | before 072.161.009.07200 |
| Xerox | Colorqube 9301 Firmware | before 072.180.009.07200 |
| Xerox | Colorqube 9302 Firmware | before 072.180.009.07200 |
| Xerox | Colorqube 9303 Firmware | before 072.180.009.07200 |
Weakness classification
References
- NVD record
- CVE.org record
- https://airbus-seclab.github.io/
- https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf
- https://airbus-seclab.github.io/
- https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf