Critical severity · published Mar 29, 2021
CVE-2021-28668
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL…
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Altalink B8045 Firmware · Xerox
before 103.008.020.23120 · source: NVD
AB
Altalink B8055 Firmware · Xerox
before 103.008.020.23120 · source: NVD
AB
Altalink B8065 Firmware · Xerox
before 103.008.020.23120 · source: NVD
AB
Altalink B8075 Firmware · Xerox
before 103.008.020.23120 · source: NVD
AB
Altalink B8090 Firmware · Xerox
before 103.008.020.23120 · source: NVD
AC
Altalink C8030 Firmware · Xerox
before 103.001.020.23120 · source: NVD
AC
Altalink C8035 Firmware · Xerox
before 103.001.020.23120 · source: NVD
AC
Altalink C8045 Firmware · Xerox
before 103.002.020.23120 · source: NVD
AC
Altalink C8055 Firmware · Xerox
before 103.002.020.23120 · source: NVD
AC
Altalink C8070 Firmware · Xerox
before 103.003.020.23120 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-28668
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-28668
Patch
https://securitydocs.business.xerox.com/wp-content/uploads/2020/09/cert_Security_Mini_Bulletin_XRX20R_for_ALB80xx-C80xx-2.pdf
More from Altalink B8045 Firmware
9.8
CVE-2019-10881
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded…
9.8
CVE-2018-17172
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before…
9.1
CVE-2021-28670
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow…
8.1
CVE-2019-18629
Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200 allow an attacker to execute…
7.5
CVE-2021-28669
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to…