Xerox: Security Vulnerabilities
A vulnerability in Xerox Workplace Suite arises from flawed token generation and the use of hard-coded keys. These weaknesses allow attackers to predict or forge tokens, leading to unauthorized access to sensitive functions.
CVSS Score
7.6
EPSS Score
0.002
Published
2025-01-23
In Xerox Workplace Suite, an API restricted to specific hosts can be bypassed by manipulating the Host header. If the server improperly validates or trusts the Host header without verifying the actual destination, an attacker can forge a value to gain unauthorized access. This exploit targets improper host validation, potentially exposing sensitive API endpoints.
CVSS Score
7.5
EPSS Score
0.001
Published
2025-01-23
Pre-Auth RCE via Path Traversal
CVSS Score
8.3
EPSS Score
0.007
Published
2024-10-07
Pre-Auth RCE via Path Traversal
CVSS Score
8.3
EPSS Score
0.007
Published
2024-10-07
Authenticated RCE via Path Traversal
CVSS Score
7.6
EPSS Score
0.005
Published
2024-10-07
Authenticated RCE via Path Traversal
CVSS Score
7.6
EPSS Score
0.005
Published
2024-10-07
Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their Address Book with encrypted form, but the encryption strength is insufficient. With the knowledge of the encryption process and the encryption key, the information such as the server credentials may be obtained from the exported Address Book data. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].
CVSS Score
5.9
EPSS Score
0.002
Published
2023-11-02
On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored cleartext credentials associated with those settings.
CVSS Score
6.5
EPSS Score
0.002
Published
2023-01-31
Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information.
CVSS Score
7.5
EPSS Score
0.003
Published
2022-04-04
Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.
CVSS Score
9.8
EPSS Score
0.004
Published
2022-02-15