CVE-2019-10881
Default hidden Privileged Account Vulnerability in multiple XEROX devices
Severity Score
9.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled.
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 con versiones de software anteriores a 103.xxx.030.32000, incluye dos cuentas con contraseñas embebidas que pueden ser explotadas y permiten el acceso no autorizado que no puede ser deshabilitado
*Credits:
Raphaël Rigo from the Airbus Security Lab
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-04-05 CVE Reserved
- 2021-04-13 CVE Published
- 2023-12-28 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-259: Use of Hard-coded Password
- CWE-798: Use of Hard-coded Credentials
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://airbus-seclab.github.io | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx.pdf | 2021-04-23 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Xerox Search vendor "Xerox" | Altalink B8045 Firmware Search vendor "Xerox" for product "Altalink B8045 Firmware" | < 103.008.010.14010 Search vendor "Xerox" for product "Altalink B8045 Firmware" and version " < 103.008.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink B8045 Search vendor "Xerox" for product "Altalink B8045" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink B8055 Firmware Search vendor "Xerox" for product "Altalink B8055 Firmware" | < 103.008.010.14010 Search vendor "Xerox" for product "Altalink B8055 Firmware" and version " < 103.008.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink B8055 Search vendor "Xerox" for product "Altalink B8055" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink B8065 Firmware Search vendor "Xerox" for product "Altalink B8065 Firmware" | < 103.008.010.14010 Search vendor "Xerox" for product "Altalink B8065 Firmware" and version " < 103.008.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink B8065 Search vendor "Xerox" for product "Altalink B8065" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink B8075 Firmware Search vendor "Xerox" for product "Altalink B8075 Firmware" | < 103.008.010.14010 Search vendor "Xerox" for product "Altalink B8075 Firmware" and version " < 103.008.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink B8075 Search vendor "Xerox" for product "Altalink B8075" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink B8090 Firmware Search vendor "Xerox" for product "Altalink B8090 Firmware" | < 103.008.010.14010 Search vendor "Xerox" for product "Altalink B8090 Firmware" and version " < 103.008.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink B8090 Search vendor "Xerox" for product "Altalink B8090" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink C8030 Firmware Search vendor "Xerox" for product "Altalink C8030 Firmware" | < 103.001.010.14010 Search vendor "Xerox" for product "Altalink C8030 Firmware" and version " < 103.001.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink C8030 Search vendor "Xerox" for product "Altalink C8030" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink C8035 Firmware Search vendor "Xerox" for product "Altalink C8035 Firmware" | < 103.001.010.14010 Search vendor "Xerox" for product "Altalink C8035 Firmware" and version " < 103.001.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink C8035 Search vendor "Xerox" for product "Altalink C8035" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink C8045 Firmware Search vendor "Xerox" for product "Altalink C8045 Firmware" | < 103.002.010.14010 Search vendor "Xerox" for product "Altalink C8045 Firmware" and version " < 103.002.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink C8045 Search vendor "Xerox" for product "Altalink C8045" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink C8055 Firmware Search vendor "Xerox" for product "Altalink C8055 Firmware" | < 103.002.010.14010 Search vendor "Xerox" for product "Altalink C8055 Firmware" and version " < 103.002.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink C8055 Search vendor "Xerox" for product "Altalink C8055" | - | - |
Safe
|
| Xerox Search vendor "Xerox" | Altalink C8070 Firmware Search vendor "Xerox" for product "Altalink C8070 Firmware" | < 103.003.010.14010 Search vendor "Xerox" for product "Altalink C8070 Firmware" and version " < 103.003.010.14010" | - |
Affected
| in | Xerox Search vendor "Xerox" | Altalink C8070 Search vendor "Xerox" for product "Altalink C8070" | - | - |
Safe
|