CVE-2021-28670 Missing authorization in n/a
Unauthorized users can delete arbitrary files from the disk via the Scan To Mailbox feature on affected Xerox printers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-28670?
CVE-2021-28670 is a critical missing authorization vulnerability in n/a, published on 29 Mar 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk.
Which versions are affected by CVE-2021-28670?
It affects 10 products.
Products include Xerox Altalink B8045 Firmware, Xerox Altalink B8055 Firmware, Xerox Altalink B8065 Firmware, Xerox Altalink B8075 Firmware, Xerox Altalink B8090 Firmware, Xerox Altalink C8030 Firmware and 4 more.
How do I fix CVE-2021-28670?
No fix has been published for CVE-2021-28670 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-28670 being exploited?
There is no known exploitation of CVE-2021-28670 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2021-28668 SQL injection in n/a
- CVE-2018-17172 Command injection in n/a
- CVE-2019-10881 Default hidden Privileged Account Vulnerability in multiple XEROX devices
- CVE-2019-18629 Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.
- CVE-2021-28669 Missing authorization in n/a
Sources
Also known as GHSA-whpg-9xjj-m9hw.