CVE-2019-10880

EUVD-2019-2602
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
airbusCNA
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
Affected Products (NVD)
VendorProductVersion
xeroxcolorqube_8700_firmware
𝑥
< 072.161.009.07200
xeroxcolorqube_8900_firmware
𝑥
< 072.161.009.07200
xeroxcolorqube_9301_firmware
𝑥
< 072.180.009.07200
xeroxcolorqube_9302_firmware
𝑥
< 072.180.009.07200
xeroxcolorqube_9303_firmware
𝑥
< 072.180.009.07200
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://airbus-seclab.github.io/
https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf
https://airbus-seclab.github.io/
https://securitydocs.business.xerox.com/wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf