CVE-2021-20679 Denial of service in Fuji Xerox multifunction devices and printers
Attackers can cause denial of service and abnormal termination on Fuji Xerox multifunction devices by sending specially crafted commands.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-20679?
CVE-2021-20679 is a high-severity denial of service vulnerability in Fuji Xerox multifunction devices and printers, published on 25 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fuji Xerox multifunction devices and printers (DocuCentre-VII C7773/C6673/C5573/C4473/C3373/C3372/C2273, DocuCentre-VII C7788/C6688/C5588, ApeosPort-VII C7773/C6673/C5573/C4473/C3373/C3372 C2273, ApeosPort-VII C7788/C6688/C5588, ApeosPort C7070/C6570/C5570/C4570/C3570/C3070/C7070G/C6570G/C5570G/C4570G/C3570G/C3070G, ApeosPort-VII C4421/C3321, ApeosPort C3060/C2560/C2060/C3060G/C2560G/C2060G, ApeosPort-VII CP4421, ApeosPort Print C5570, ApeosPort 5570/4570/5570G/4570G, ApeosPort 3560/3060/2560/3560G/3060G/2560G, ApeosPort-VII 5021/ 4021, ApeosPort-VII P5021, DocuPrint CP 555 d/505 d, DocuPrint P505 d, PrimeLink C9065/C9070, DocuPrint CP475AP, and DocuPrint P475AP) allow an attacker to cause a denial of service (DoS) condition and abnormal end (ABEND) of the affected products via sending a specially crafted command.
Which versions are affected by CVE-2021-20679?
It affects 75 products.
Products include Fujixerox Apeosport-Vii 4021 Firmware, Fujixerox Apeosport-Vii 5021 Firmware, Fujixerox Apeosport-Vii 5022 Firmware, Fujixerox Apeosport-Vii C2273 Firmware, Fujixerox Apeosport-Vii C3321 Firmware, Fujixerox Apeosport-Vii C3322 Firmware and 69 more.
How do I fix CVE-2021-20679?
No fix has been published for CVE-2021-20679 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-20679 being exploited?
There is no known exploitation of CVE-2021-20679 in the wild and no public exploit code.
Sources
Also known as GHSA-pgh9-mf3w-56cj.