Strix
26.1K

CVE-2016-11061

CRITICALCVSS 9.8/10EPSS 1.99%

Last modified

CVE-2016-11061 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.. EPSS estimates a 1.99% chance of exploitation in the next 30 days.

Description

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

Metrics

CVSS 3.1
9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
1.99%

78.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
XeroxWorkcentre 3655 Firmware< 073.060.086.15410
XeroxWorkcentre 3655i Firmware< 073.060.086.15410
XeroxWorkcentre 5865 Firmware< 073.190.086.15410
XeroxWorkcentre 5875 Firmware< 073.190.086.15410
XeroxWorkcentre 5890 Firmware< 073.190.086.15410
XeroxWorkcentre 5865i Firmware< 073.190.086.15410
XeroxWorkcentre 5875i Firmware< 073.190.086.15410
XeroxWorkcentre 5890i Firmware< 073.190.086.15410
XeroxWorkcentre 5945 Firmware< 073.091.086.15410
XeroxWorkcentre 5955 Firmware< 073.091.086.15410
XeroxWorkcentre 5945i Firmware< 073.091.086.15410
XeroxWorkcentre 5955i Firmware< 073.091.086.15410
XeroxWorkcentre 6655 Firmware< 073.110.086.15410
XeroxWorkcentre 6655i Firmware< 073.110.086.15410
XeroxWorkcentre 7200 Firmware< 073.030.086.15410
XeroxWorkcentre 7200i Firmware< 073.030.086.15410
XeroxWorkcentre 7225i Firmware< 073.030.086.15410
XeroxWorkcentre 7830 Firmware< 073.010.086.15410
XeroxWorkcentre 7835 Firmware< 073.010.086.15410
XeroxWorkcentre 7845 Firmware< 073.010.086.15410
XeroxWorkcentre 7855 Firmware< 073.010.086.15410
XeroxWorkcentre 7970 Firmware< 073.200.086.15410
XeroxWorkcentre 7970i Firmware< 073.200.086.15410
XeroxWorkcentre 7225 Firmware< 073.030.086.15410
XeroxWorkcentre 7220 Firmware< 073.030.086.15410

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2016-11061?
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.
How severe is CVE-2016-11061?
CVE-2016-11061 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.99% probability of exploitation in the next 30 days.
How do I fix CVE-2016-11061?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2016

View all 2016CVEs →

Are you affected by CVE-2016-11061?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST