High severity · published Mar 4, 2021
CVE-2019-18630
On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Altalink B8045 Firmware · Xerox
before 103.008.010.14010 · source: NVD
AB
Altalink B8055 Firmware · Xerox
before 103.008.010.14010 · source: NVD
AB
Altalink B8065 Firmware · Xerox
before 103.008.010.14010 · source: NVD
AB
Altalink B8075 Firmware · Xerox
before 103.008.010.14010 · source: NVD
AB
Altalink B8090 Firmware · Xerox
before 103.008.010.14010 · source: NVD
AC
Altalink C8030 Firmware · Xerox
before 103.001.010.14010 · source: NVD
AC
Altalink C8035 Firmware · Xerox
before 103.001.010.14010 · source: NVD
AC
Altalink C8045 Firmware · Xerox
before 103.002.010.14010 · source: NVD
AC
Altalink C8055 Firmware · Xerox
before 103.002.010.14010 · source: NVD
AC
Altalink C8070 Firmware · Xerox
before 103.003.010.14010 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18630
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18630
Vendor Advisory
https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX20I_for_ALB80xx-C80xx_v1.2.pdf
More from Altalink B8045 Firmware
9.8
CVE-2019-10881
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded…
9.8
CVE-2021-28668
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL…
9.8
CVE-2018-17172
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before…
9.1
CVE-2021-28670
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow…
8.1
CVE-2019-18629
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute…