CVE-2020-9330

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP address to a system owned by the actor without knowledge of the LDAP bind credentials. After changing the LDAP connection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Directory) credentials to the actor. Although the credentials may belong to a non-privileged user, organizations frequently use privileged service accounts to bind to Active Directory. The attacker gains a foothold on the Active Directory domain at a minimum, and may use the credentials to take over control of the Active Directory domain. This affects 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**, 72XX*, 72XXi*, 78XX**, 78XXi**, 7970**, 7970i**, EC7836**, and EC7856** devices.

• CWE-306

• https://securitydocs.business.xerox.com/wp-content/uploads/2020/02/cert_Security_Mini_Bulletin_XRX20D_for_ConnectKey.pdfPatch, Vendor Advisory
• https://www.securicon.com/hackers-can-gain-active-directory-privileges-through-new-vulnerability-in-xerox-printers/Exploit, Third Party Advisory
• https://securitydocs.business.xerox.com/wp-content/uploads/2020/02/cert_Security_Mini_Bulletin_XRX20D_for_ConnectKey.pdfPatch, Vendor Advisory
• https://www.securicon.com/hackers-can-gain-active-directory-privileges-through-new-vulnerability-in-xerox-printers/Exploit, Third Party Advisory

Published

Feb 21, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-9323Aquaforest TIFF Server 4.0 allows Unauthenticated File and D…5.3
• CVE-2020-9324Aquaforest TIFF Server 4.0 allows Unauthenticated SMB Hash C…7.5
• CVE-2020-9325Aquaforest TIFF Server 4.0 allows Unauthenticated Arbitrary …7.5
• CVE-2020-9326BeyondTrust Privilege Management for Windows and Mac (aka PM…7.5
• CVE-2020-9327In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers t…7.5
• CVE-2020-9329Gogs through 0.11.91 allows attackers to violate the admin-s…5.9
• CVE-2020-9331CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows…7.8
• CVE-2020-9332ftusbbus2.sys in FabulaTech USB for Remote Desktop through 2…7.8
• CVE-2020-9334A stored XSS vulnerability exists in the Envira Photo Galler…5.4
• CVE-2020-9335Multiple stored XSS vulnerabilities exist in the 10Web Photo…4.8
• CVE-2020-9336fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> S…5.4
• CVE-2020-9337In GolfBuddy Course Manager 1.1, passwords are sent (with ba…6.5