CVE-2018-16709 Path traversal in n/a
Remote attackers can read or write arbitrary files on Fuji Xerox multifunction printers via crafted PJL commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-16709?
CVE-2018-16709 is a critical path traversal vulnerability in n/a, published on 7 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands.
Which versions are affected by CVE-2018-16709?
It affects 9 products.
Products include Fujixerox Apeosport-v 5070 Firmware, Fujixerox Apeosport-v C3375 Firmware, Fujixerox Apeosport-v C4475 Firmware, Fujixerox Apeosport-v C5576 Firmware, Fujixerox Apeosport-Vi C3371 Firmware, Fujixerox Docucentre-Iv C2263 Firmware and 3 more.
How do I fix CVE-2018-16709?
No fix has been published for CVE-2018-16709 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-16709 being exploited?
There is no known exploitation of CVE-2018-16709 in the wild and no public exploit code.
Sources
Also known as GHSA-4gcj-jpgr-v4r6.