CVE-2019-10880 Command injection in AltaLink B8045/B8055/B8065/B8075/B8090
Remote attackers can execute arbitrary commands on Xerox printers via crafted HTTP requests, potentially gaining control of the device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-10880?
CVE-2019-10880 is a critical command injection vulnerability in XEROX AltaLink B8045/B8055/B8065/B8075/B8090, published on 12 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
Weakness: CWE-78
Which versions are affected by CVE-2019-10880?
It affects 5 products.
Products include Xerox Colorqube 8700 Firmware, Xerox Colorqube 8900 Firmware, Xerox Colorqube 9301 Firmware, Xerox Colorqube 9302 Firmware, Xerox Colorqube 9303 Firmware.
How do I fix CVE-2019-10880?
No fix has been published for CVE-2019-10880 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-10880 being exploited?
There is no known exploitation of CVE-2019-10880 in the wild and no public exploit code.
Sources
Also known as GHSA-cp66-c3r7-36c5.