Back to Database
Status published
Critical
CVE-2016-11061
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i,...
Vulnerability Description
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-11061
Credits & Attribution
No credits recorded in the NVD database.
More from xerox
View All →CVE-2022-45897
On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can...
Unknown
0
CVE-2022-26572
Xerox ColorQube 8580 was discovered to contain an access control...
High
7.5
CVE-2022-23968
Xerox VersaLink devices on specific versions of firmware before 2022-01-26...
High
7.5
CVE-2022-23321
A persistent cross-site scripting (XSS) vulnerability exists on two input...
Medium
4.8
CVE-2022-23320
XMPie uStore 12.3.7244.0 allows for administrators to generate reports based...
High
7.5
Affected Vendor
xerox
View all reports →Affected Software
workcentre 3655 firmware, workcentre 3655i firmware, workcentre 5865 firmware, workcentre 5875 firmware, workcentre 5890 firmware, workcentre 5865i firmware, workcentre 5875i firmware, workcentre 5890i firmware, workcentre 5945 firmware, workcentre 5955 firmware, workcentre 5945i firmware, workcentre 5955i firmware, workcentre 6655 firmware, workcentre 6655i firmware, workcentre 7200 firmware, workcentre 7200i firmware, workcentre 7225i firmware, workcentre 7830 firmware, workcentre 7835 firmware, workcentre 7845 firmware, workcentre 7855 firmware, workcentre 7970 firmware, workcentre 7970i firmware, workcentre 7225 firmware, workcentre 7220 firmware
Vulnerable Versions:
0
Timeline
Official Publish:
April 29th, 2020
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.