VulnerabilityModified

CVE-2021-20679

HIGH 7.5EPSS 1.55%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/C6673/C5573/C4473/C3373/C3372 C2273, ApeosPort-VII C7788/C6688/C5588, ApeosPort C7070/C6570/C5570/C4570/C3570/C3070/C7070G/C6570G/C5570G/C4570G/C3570G/C3070G, ApeosPort-VII C4421/C3321, ApeosPort C3060/C2560/C2060/C3060G/C2560G/C2060G, ApeosPort-VII CP4421, ApeosPort Print C5570, ApeosPort 5570/4570/5570G/4570G, ApeosPort 3560/3060/2560/3560G/3060G/2560G, ApeosPort-VII 5021/ 4021, ApeosPort-VII P5021, DocuPrint CP 555 d/505 d, DocuPrint P505 d, PrimeLink C9065/C9070, DocuPrint CP475AP, and DocuPrint P475AP) allow an attacker to cause a denial of service (DoS) condition and abnormal end (ABEND) of the affected products via sending a specially crafted command.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS: 1.55% probability · 74th percentile
CISA KEV: Not listed
Affected: fujixerox/docucentre-vii c7773 firmware · fujixerox/docucentre-vii c6673 firmware · fujixerox/docucentre-vii c5573 firmware · fujixerox/docucentre-vii c4473 firmware · fujixerox/docucentre-vii c3373 firmware · fujixerox/docucentre-vii c3372 firmware · fujixerox/docucentre-vii c2273 firmware · fujixerox/apeosport c2570 firmware · fujixerox/apeosport-vii c4422 firmware · fujixerox/apeosport-vii c3322 firmware · fujixerox/apeosport c2360 firmware · fujixerox/apeosport c2060 firmware · fujixerox/apeosport-vii cp4422 firmware · fujixerox/apeosport-vii cp3322 firmware · fujixerox/apeosport print c4570 firmware · fujixerox/apeosport 3570 firmware · fujixerox/apeosport 1860 firmware · fujixerox/apeosport-vii 5022 firmware · fujixerox/apeosport-vii p4022 firmware · fujixerox/docucentre-vi c2264 firmware · +40 more
Source: vultures@jpcert.or.jp

References

https://jvn.jp/en/jp/JVN37607293/index.htmlThird Party Advisory
https://www.fujixerox.co.jp/company/news/notice/2021/0319_announce.htmlVendor Advisory
https://www.fujixerox.com/eng/company/news/notice/2021/0319_announce.htmlVendor Advisory
https://jvn.jp/en/jp/JVN37607293/index.htmlThird Party Advisory
https://www.fujixerox.co.jp/company/news/notice/2021/0319_announce.htmlVendor Advisory
https://www.fujixerox.com/eng/company/news/notice/2021/0319_announce.htmlVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.