Xerox vulnerabilities
99 vulnerabilities
Known vulnerabilities in Xerox products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 221 products.
Products
50 of 221- Workcentre20 vulnerabilities
- Altalink C80359 vulnerabilities
- Freeflow Core9 vulnerabilities
- Workcentre 36559 vulnerabilities
- Workcentre 66559 vulnerabilities
- Workcentre 79709 vulnerabilities
- Workcentre Ec78369 vulnerabilities
- Workcentre Ec78569 vulnerabilities
- Altalink B80458 vulnerabilities
- Altalink B80558 vulnerabilities
- Altalink B80658 vulnerabilities
- Altalink B80758 vulnerabilities
- Altalink B80908 vulnerabilities
- Altalink C80308 vulnerabilities
- Altalink C80458 vulnerabilities
- Altalink C80558 vulnerabilities
- Altalink C80708 vulnerabilities
- Phaser 33208 vulnerabilities
- Workcentre 3655I8 vulnerabilities
- Workcentre 6655I8 vulnerabilities
- Workcentre 72208 vulnerabilities
- Workcentre 72258 vulnerabilities
- Workcentre 78308 vulnerabilities
- Workcentre 78358 vulnerabilities
- Workcentre 78458 vulnerabilities
- Workcentre 78558 vulnerabilities
- Workcentre 7970I8 vulnerabilities
- Workcentre 58657 vulnerabilities
- Workcentre 5865I7 vulnerabilities
- Workcentre 58757 vulnerabilities
- Workcentre 5875I7 vulnerabilities
- Workcentre 58907 vulnerabilities
- Workcentre 5890I7 vulnerabilities
- Workcentre 7225I7 vulnerabilities
- Workplace Suite7 vulnerabilities
- Xerox Workplace Suite7 vulnerabilities
- Versalink B4056 vulnerabilities
- Versalink C4056 vulnerabilities
- Versalink C70006 vulnerabilities
- Workcentre 58456 vulnerabilities
- Workcentre 65156 vulnerabilities
- Workcentre 7220I6 vulnerabilities
- Workcentre 7830I6 vulnerabilities
- Workcentre 7835I6 vulnerabilities
- Workcentre 7845I6 vulnerabilities
- Workcentre 7855I6 vulnerabilities
- Phaser 65105 vulnerabilities
- Versalink B4005 vulnerabilities
- Versalink C4005 vulnerabilities
- Workcentre 21285 vulnerabilities
CVE-2018-20769xeroxworkcentre_3655_firmware+28
EPSS score1.44%
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is a Local File Inclusion vulnerability.CVE-2018-20771xeroxworkcentre_3655_firmware+28EPSS score3.08%
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is unauthenticated Remote Command Execution.CVE-2018-20767xeroxworkcentre_3655_firmware+28EPSS score2.24%
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is authenticated remote command execution.CVE-2018-20768xeroxworkcentre_3655_firmware+28EPSS score1.23%
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. An attacker can execute PHP code by leveraging a writable file.CVE-2018-20770xeroxworkcentre_3655_firmware+28EPSS score1.06%
An issue was discovered on Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, 7970i, EC7836, and EC7856 devices before R18-05 073.xxx.0487.15000. There is Blind SQL Injection.CVE-2018-17172xeroxaltalink_b8045_firmware+9EPSS score1.97%
The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before 100.001.028.05200, C8045/C8055 before 100.002.028.05200, and C8070 before 100.003.028.05200 allows unauthenticated command injection.CVE-2018-15530xeroxcolorqube_8580_firmwareEPSS score0.69%
Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.CVE-2013-0407sunsunos+1EPSS score0.35%
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/DTrace Framework.CVE-2013-0415sunsunos+1EPSS score0.30%
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Bind/Postinstall script for Bind package.CVE-2013-6362xeroxcolorqube_9201_firmware+11EPSS score1.18%
Xerox ColorCube and WorkCenter devices in 2013 had hardcoded FTP and shell user accounts.CVE-2021-37354xeroxphaser_4622_firmwareEPSS score1.38%
Xerox Phaser 4622 v35.013.01.000 was discovered to contain a buffer overflow in the function sub_3226AC via the TIMEZONE variable. This vulnerability allows attackers to cause a Denial of Service (DoS) via crafted overflow data.CVE-2021-28672xeroxphaser_6510_firmware+23EPSS score2.24%
Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 allows remote attackers to execute arbitrary code through a buffer overflow in Web page parameter handling.CVE-2021-28668xeroxaltalink_b8045_firmware+9EPSS score1.08%
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 has several SQL injection vulnerabilities.CVE-2021-28673xeroxphaser_6510_firmware+22EPSS score1.94%
Xerox Phaser 6510 before 64.61.23 and 64.59.11 (Bridge), WorkCentre 6515 before 65.61.23 and 65.59.11 (Bridge), VersaLink B400 before 37.61.23 and 37.59.01 (Bridge), B405 before 38.61.23 and 38.59.01 (Bridge), B600/B610 before 32.61.23 and 32.59.01 (Bridge), B605/B615 before 33.61.23 and 33.59.01 (Bridge), B7025/30/35 before 58.61.23 and 58.59.11 (Bridge), C400 before 67.61.23 and 67.59.01 (Bridge), C405 before 68.61.23 and 68.59.01 (Bridge), C500/C600 before 61.61.23 and 61.59.01 (Bridge), C505/C605 before 62.61.23 and 62.59.11 (Bridge), C7000 before 56.61.23 and 56.59.01 (Bridge), C7020/25/30 before 57.61.23 and 57.59.01 (Bridge), C8000/C9000 before 70.61.23 and 70.59.01 (Bridge), allows remote attackers with "a weaponized clone file" to execute arbitrary commands in the Web User Interface.CVE-2021-28671xeroxphaser_6510_firmware+23EPSS score2.67%
Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 have a remote Command Execution vulnerability in the Web User Interface that allows remote attackers with "a weaponized clone file" to execute arbitrary commands.CVE-2021-28669xeroxaltalink_b8045_firmware+9EPSS score0.87%
Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120, C8045/C8055 before 103.002.020.23120 and C8070 before 103.003.020.23120 provide the ability to set configuration attributes without administrative rights.CVE-2021-28670xeroxaltalink_b8045_firmware+9EPSS score1.07%
Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before 103.001.030.32000, C8045/C8055 before 103.002.030.32000 and C8070 before 103.003.030.32000 allow unauthorized users, by leveraging the Scan To Mailbox feature, to delete arbitrary files from the disk.CVE-2016-11061xeroxworkcentre_3655_firmware+24EPSS score1.99%
Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.CVE-2025-1984xeroxxerox® desktop print experienceEPSS score0.14%
Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level access.CVE-2025-8355xeroxfreeflow_coreEPSS score8.81%
In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing references to internal URLs, this results in a Server-Side Request Forgery (SSRF).