CVE-2021-28669 Missing authorization in n/a
Attackers can modify configuration attributes on Xerox AltaLink printers without administrative rights, potentially altering device settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28669?
CVE-2021-28669 is a high-severity missing authorization vulnerability in n/a, published on 29 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights.
Weakness: CWE-862
Which versions are affected by CVE-2021-28669?
It affects 10 products.
Products include Xerox Altalink B8045 Firmware, Xerox Altalink B8055 Firmware, Xerox Altalink B8065 Firmware, Xerox Altalink B8075 Firmware, Xerox Altalink B8090 Firmware, Xerox Altalink C8030 Firmware and 4 more.
How do I fix CVE-2021-28669?
No fix has been published for CVE-2021-28669 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-28669 being exploited?
There is no known exploitation of CVE-2021-28669 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-28668 SQL injection in n/a
- CVE-2018-17172 Command injection in n/a
- CVE-2019-10881 Default hidden Privileged Account Vulnerability in multiple XEROX devices
- CVE-2021-28670 Missing authorization in n/a
- CVE-2019-18629 Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.
Sources
Also known as GHSA-37r3-92cr-vf6c.