CVE-2016-11061
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.99%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.99% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- xerox/workcentre 3655 firmware · xerox/workcentre 3655i firmware · xerox/workcentre 5865 firmware · xerox/workcentre 5875 firmware · xerox/workcentre 5890 firmware · xerox/workcentre 5865i firmware · xerox/workcentre 5875i firmware · xerox/workcentre 5890i firmware · xerox/workcentre 5945 firmware · xerox/workcentre 5955 firmware · xerox/workcentre 5945i firmware · xerox/workcentre 5955i firmware · xerox/workcentre 6655 firmware · xerox/workcentre 6655i firmware · xerox/workcentre 7200 firmware · xerox/workcentre 7200i firmware · xerox/workcentre 7225i firmware · xerox/workcentre 7830 firmware · xerox/workcentre 7835 firmware · xerox/workcentre 7845 firmware · +5 more
- Source
- cve@mitre.org
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.