Vulnerability Name:

CVE-2018-20767 (CCN-157465)

Assigned:2018-06-28
Published:2018-06-28
Updated:2019-02-13
Summary:An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is authenticated remote command execution.
CVSS v3 Severity:8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
9.8 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
8.5 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2018-20767

Source: XF
Type: UNKNOWN
xerox-cve201820767-command-exec(157465)

Source: CCN
Type: XEROX Mini Bulletin XRX18Y
Xerox WorkCentre

Source: CONFIRM
Type: Vendor Advisory
https://securitydocs.business.xerox.com/wp-content/uploads/2018/07/cert_Security_Mini_Bulletin_XRX18Y_for_ConnectKey_EC78xx_v1.0.pdf

Vulnerable Configuration:Configuration 1:
  • cpe:/o:xerox:workcentre_3655i_firmware:*:*:*:*:*:*:*:* (Version < 073.060.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_3655i:-:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:xerox:workcentre_3655_firmware:*:*:*:*:*:*:*:* (Version < 073.060.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_3655:-:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:xerox:workcentre_5890i_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5890i:-:*:*:*:*:*:*:*

    • Configuration 4:
  • cpe:/o:xerox:workcentre_5865i_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5865i:-:*:*:*:*:*:*:*

    • Configuration 5:
  • cpe:/o:xerox:workcentre_5875i_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5875i:-:*:*:*:*:*:*:*

    • Configuration 6:
  • cpe:/o:xerox:workcentre_5845_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5845:-:*:*:*:*:*:*:*

    • Configuration 7:
  • cpe:/o:xerox:workcentre_5865_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5865:-:*:*:*:*:*:*:*

    • Configuration 8:
  • cpe:/o:xerox:workcentre_5875_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5875:-:*:*:*:*:*:*:*

    • Configuration 9:
  • cpe:/o:xerox:workcentre_5890_firmware:*:*:*:*:*:*:*:* (Version < 073.190.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5890:-:*:*:*:*:*:*:*

    • Configuration 10:
  • cpe:/o:xerox:workcentre_5900_firmware:*:*:*:*:*:*:*:* (Version < 073.091.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5900:-:*:*:*:*:*:*:*

    • Configuration 11:
  • cpe:/o:xerox:workcentre_5900i_firmware:*:*:*:*:*:*:*:* (Version < 073.091.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_5900i:-:*:*:*:*:*:*:*

    • Configuration 12:
  • cpe:/o:xerox:workcentre_6655_firmware:*:*:*:*:*:*:*:* (Version < 073.110.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_6655:-:*:*:*:*:*:*:*

    • Configuration 13:
  • cpe:/o:xerox:workcentre_6655i_firmware:*:*:*:*:*:*:*:* (Version < 073.110.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_6655i:-:*:*:*:*:*:*:*

    • Configuration 14:
  • cpe:/o:xerox:workcentre_7855_firmware:*:*:*:*:*:*:*:* (Version < 073.040.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7855:-:*:*:*:*:*:*:*

    • Configuration 15:
  • cpe:/o:xerox:workcentre_7225_firmware:*:*:*:*:*:*:*:* (Version < 073.030.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7225:-:*:*:*:*:*:*:*

    • Configuration 16:
  • cpe:/o:xerox:workcentre_7220_firmware:*:*:*:*:*:*:*:* (Version < 073.030.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7220:-:*:*:*:*:*:*:*

    • Configuration 17:
  • cpe:/o:xerox:workcentre_7220i_firmware:*:*:*:*:*:*:*:* (Version < 073.030.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7220i:-:*:*:*:*:*:*:*

    • Configuration 18:
  • cpe:/o:xerox:workcentre_7225i_firmware:*:*:*:*:*:*:*:* (Version < 073.030.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7225i:-:*:*:*:*:*:*:*

    • Configuration 19:
  • cpe:/o:xerox:workcentre_7855i_firmware:*:*:*:*:*:*:*:* (Version < 073.040.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7855i:-:*:*:*:*:*:*:*

    • Configuration 20:
  • cpe:/o:xerox:workcentre_7845i_firmware:*:*:*:*:*:*:*:* (Version < 073.040.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7845i:-:*:*:*:*:*:*:*

    • Configuration 21:
  • cpe:/o:xerox:workcentre_7835i_firmware:*:*:*:*:*:*:*:* (Version < 073.010.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7835i:-:*:*:*:*:*:*:*

    • Configuration 22:
  • cpe:/o:xerox:workcentre_7830i_firmware:*:*:*:*:*:*:*:* (Version < 073.010.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7830i:-:*:*:*:*:*:*:*

    • Configuration 23:
  • cpe:/o:xerox:workcentre_7830_firmware:*:*:*:*:*:*:*:* (Version < 073.010.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7830:-:*:*:*:*:*:*:*

    • Configuration 24:
  • cpe:/o:xerox:workcentre_7835_firmware:*:*:*:*:*:*:*:* (Version < 073.010.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7835:-:*:*:*:*:*:*:*

    • Configuration 25:
  • cpe:/o:xerox:workcentre_7845_firmware:*:*:*:*:*:*:*:* (Version < 073.040.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7845:-:*:*:*:*:*:*:*

    • Configuration 26:
  • cpe:/o:xerox:workcentre_7970_firmware:*:*:*:*:*:*:*:* (Version < 073.200.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7970:-:*:*:*:*:*:*:*

    • Configuration 27:
  • cpe:/o:xerox:workcentre_7970i_firmware:*:*:*:*:*:*:*:* (Version < 073.200.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_7970i:-:*:*:*:*:*:*:*

    • Configuration 28:
  • cpe:/o:xerox:workcentre_ec7836_firmware:*:*:*:*:*:*:*:* (Version < 073.050.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_ec7836:-:*:*:*:*:*:*:*

    • Configuration 29:
  • cpe:/o:xerox:workcentre_ec7856_firmware:*:*:*:*:*:*:*:* (Version < 073.020.048.15000)
  • AND
  • cpe:/h:xerox:workcentre_ec7856:-:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/h:xerox:workcentre_3655:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_3655i:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_6655:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_6655i:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_7970:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_7970i:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_ec7836:-:*:*:*:*:*:*:*
  • OR cpe:/h:xerox:workcentre_ec7856:-:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    xerox workcentre 3655i firmware *
    xerox workcentre 3655i -
    xerox workcentre 3655 firmware *
    xerox workcentre 3655 -
    xerox workcentre 5890i firmware *
    xerox workcentre 5890i -
    xerox workcentre 5865i firmware *
    xerox workcentre 5865i -
    xerox workcentre 5875i firmware *
    xerox workcentre 5875i -
    xerox workcentre 5845 firmware *
    xerox workcentre 5845 -
    xerox workcentre 5865 firmware *
    xerox workcentre 5865 -
    xerox workcentre 5875 firmware *
    xerox workcentre 5875 -
    xerox workcentre 5890 firmware *
    xerox workcentre 5890 -
    xerox workcentre 5900 firmware *
    xerox workcentre 5900 -
    xerox workcentre 5900i firmware *
    xerox workcentre 5900i -
    xerox workcentre 6655 firmware *
    xerox workcentre 6655 -
    xerox workcentre 6655i firmware *
    xerox workcentre 6655i -
    xerox workcentre 7855 firmware *
    xerox workcentre 7855 -
    xerox workcentre 7225 firmware *
    xerox workcentre 7225 -
    xerox workcentre 7220 firmware *
    xerox workcentre 7220 -
    xerox workcentre 7220i firmware *
    xerox workcentre 7220i -
    xerox workcentre 7225i firmware *
    xerox workcentre 7225i -
    xerox workcentre 7855i firmware *
    xerox workcentre 7855i -
    xerox workcentre 7845i firmware *
    xerox workcentre 7845i -
    xerox workcentre 7835i firmware *
    xerox workcentre 7835i -
    xerox workcentre 7830i firmware *
    xerox workcentre 7830i -
    xerox workcentre 7830 firmware *
    xerox workcentre 7830 -
    xerox workcentre 7835 firmware *
    xerox workcentre 7835 -
    xerox workcentre 7845 firmware *
    xerox workcentre 7845 -
    xerox workcentre 7970 firmware *
    xerox workcentre 7970 -
    xerox workcentre 7970i firmware *
    xerox workcentre 7970i -
    xerox workcentre ec7836 firmware *
    xerox workcentre ec7836 -
    xerox workcentre ec7856 firmware *
    xerox workcentre ec7856 -
    xerox workcentre 3655 -
    xerox workcentre 3655i -
    xerox workcentre 6655 -
    xerox workcentre 6655i -
    xerox workcentre 7970 -
    xerox workcentre 7970i -
    xerox workcentre ec7836 -
    xerox workcentre ec7856 -