CVE-2018-17172 Command injection in n/a
Unauthenticated attackers can execute arbitrary commands on Xerox AltaLink printers via the web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-17172?
CVE-2018-17172 is a critical command injection vulnerability in n/a, published on 3 Jan 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.
Weakness: CWE-77
Which versions are affected by CVE-2018-17172?
It affects 10 products.
Products include Xerox Altalink B8045 Firmware, Xerox Altalink B8055 Firmware, Xerox Altalink B8065 Firmware, Xerox Altalink B8075 Firmware, Xerox Altalink B8090 Firmware, Xerox Altalink C8030 Firmware and 4 more.
How do I fix CVE-2018-17172?
No fix has been published for CVE-2018-17172 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-17172 being exploited?
There is no known exploitation of CVE-2018-17172 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-28668 SQL injection in n/a
- CVE-2019-10881 Default hidden Privileged Account Vulnerability in multiple XEROX devices
- CVE-2021-28670 Missing authorization in n/a
- CVE-2019-18629 Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.
- CVE-2021-28669 Missing authorization in n/a
Sources
Also known as GHSA-7c5c-3c2x-v5q8.