Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-9330

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP address to a system owned by the actor without knowledge of the LDAP bind credentials. After changing the LDAP connection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Directory) credentials to the actor. Although the credentials may belong to a non-privileged user, organizations frequently use privileged service accounts to bind to Active Directory. The attacker gains a foothold on the Active Directory domain at a minimum, and may use the credentials to take over control of the Active Directory domain. This affects 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**, 72XX*, 72XXi*, 78XX**, 78XXi**, 7970**, 7970i**, EC7836**, and EC7856** devices.

Published

2020-02-21T23:15:11.497

Last Modified

2024-11-21T05:40:25.413

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-306
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System xerox workcentre_3655_firmware < 073.060.000.02300 Yes
Hardware xerox workcentre_3655 - No
Operating System xerox workcentre_3655i_firmware < 073.060.000.02300 Yes
Hardware xerox workcentre_3655i - No
Operating System xerox workcentre_5845_firmware < 073.190.000.02300 Yes
Hardware xerox workcentre_5845 - No
Operating System xerox workcentre_5855_firmware < 073.190.000.02300 Yes
Hardware xerox workcentre_5855 - No
Operating System xerox workcentre_5945_firmware < 073.091.000.02300 Yes
Hardware xerox workcentre_5945 - No
Operating System xerox workcentre_5955_firmware < 073.091.000.02300 Yes
Hardware xerox workcentre_5955 - No
Operating System xerox workcentre_6655_firmware < 073.110.000.02300 Yes
Hardware xerox workcentre_6655 - No
Operating System xerox workcentre_6655i_firmware < 073.110.000.02300 Yes
Hardware xerox workcentre_6655i - No
Operating System xerox workcentre_7220_firmware < 073.030.000.02300 Yes
Hardware xerox workcentre_7220 - No
Operating System xerox workcentre_7225_firmware < 073.030.000.02300 Yes
Hardware xerox workcentre_7225 - No
Operating System xerox workcentre_7830_firmware < 073.010.000.02300 Yes
Hardware xerox workcentre_7830 - No
Operating System xerox workcentre_7835_firmware < 073.010.000.02300 Yes
Hardware xerox workcentre_7835 - No
Operating System xerox workcentre_7845_firmware < 073.010.000.02300 Yes
Hardware xerox workcentre_7845 - No
Operating System xerox workcentre_7855_firmware < 073.010.000.02300 Yes
Hardware xerox workcentre_7855 - No
Operating System xerox workcentre_7970_firmware < 073.200.000.02300 Yes
Hardware xerox workcentre_7970 - No
Operating System xerox workcentre_7970i_firmware < 073.200.000.02300 Yes
Hardware xerox workcentre_7970i - No
Operating System xerox workcentre_ec7836_firmware < 073.050.000.02300 Yes
Hardware xerox workcentre_ec7836 - No
Operating System xerox workcentre_ec7856_firmware < 073.020.000.02300 Yes
Hardware xerox workcentre_ec7856 - No
References