OS command injection in Xerox AltaLink B8045/B8055/B8065/B8075/B8090
Priority MEDIUM 53CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.
Why it matters now
EPSS 0.08468 95th percentileScored 2026-11-07
Fix Fixed ColorQube 9301/9302/9303 (XEROX): 072.xxx.009.07200ColorQube 8700/8900 (XEROX): 072.xxx.009.07200
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Xerox | AltaLink B8045/B8055/B8065/B8075/B8090 | — | — | No fix listed | CNA |
| Xerox | AltaLink C8030/C8035/C8045/C8055/C8070 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 3655 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 5845/5855/5865/5875/5890 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 5945/5955 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 6655 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 7220/7225 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 7830/7835/7845/7855 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 7970 | — | — | No fix listed | CNA |
| Xerox | WorkCentre EC7836/EC7856 | — | — | No fix listed | CNA |
| Xerox | ColorQube 9301/9302/9303 | before 072.xxx.009.07200 | 072.xxx.009.07200 | Patch available | CNA |
| Xerox | ColorQube 8700/8900 | before 072.xxx.009.07200 | 072.xxx.009.07200 | Patch available | CNA |
| Xerox | WorkCentre 6400 | — | — | No fix listed | CNA |
| Xerox | Phaser 6700 | — | — | No fix listed | CNA |
| Xerox | Phaser 7800 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 5735/5740/5745/5755/5765/5775/5790 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 7525/7530/7535/7545/7556 | — | — | No fix listed | CNA |
| Xerox | WorkCentre 7755/7765/7775 | — | — | No fix listed | CNA |
- AltaLink B8045/B8055/B8065/B8075/B8090 VendorXerox Affected — Fixed in — No fix listed CNA
- AltaLink C8030/C8035/C8045/C8055/C8070 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 3655 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 5845/5855/5865/5875/5890 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 5945/5955 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 6655 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 7220/7225 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 7830/7835/7845/7855 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 7970 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre EC7836/EC7856 VendorXerox Affected — Fixed in — No fix listed CNA
- ColorQube 9301/9302/9303 VendorXerox Affected before 072.xxx.009.07200 Fixed in 072.xxx.009.07200 Patch available CNA
- ColorQube 8700/8900 VendorXerox Affected before 072.xxx.009.07200 Fixed in 072.xxx.009.07200 Patch available CNA
- WorkCentre 6400 VendorXerox Affected — Fixed in — No fix listed CNA
- Phaser 6700 VendorXerox Affected — Fixed in — No fix listed CNA
- Phaser 7800 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 5735/5740/5745/5755/5765/5775/5790 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 7525/7530/7535/7545/7556 VendorXerox Affected — Fixed in — No fix listed CNA
- WorkCentre 7755/7765/7775 VendorXerox Affected — Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:xerox:colorqube_8700_firmware:*:*:*:*:*:*:*:* | before 072.161.009.07200 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:colorqube_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:colorqube_8900_firmware:*:*:*:*:*:*:*:* | before 072.161.009.07200 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:colorqube_8900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:colorqube_9301_firmware:*:*:*:*:*:*:*:* | before 072.180.009.07200 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:colorqube_9301:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:colorqube_9302_firmware:*:*:*:*:*:*:*:* | before 072.180.009.07200 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:colorqube_9302:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:colorqube_9303_firmware:*:*:*:*:*:*:*:* | before 072.180.009.07200 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:colorqube_9303:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
- cpe:2.3:o:xerox:colorqube_8700_firmware:*:*:*:*:*:*:*:* Versions before 072.161.009.07200 Vulnerable ·Xerox
- cpe:2.3:h:xerox:colorqube_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:colorqube_8900_firmware:*:*:*:*:*:*:*:* Versions before 072.161.009.07200 Vulnerable ·Xerox
- cpe:2.3:h:xerox:colorqube_8900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:colorqube_9301_firmware:*:*:*:*:*:*:*:* Versions before 072.180.009.07200 Vulnerable ·Xerox
- cpe:2.3:h:xerox:colorqube_9301:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:colorqube_9302_firmware:*:*:*:*:*:*:*:* Versions before 072.180.009.07200 Vulnerable ·Xerox
- cpe:2.3:h:xerox:colorqube_9302:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:colorqube_9303_firmware:*:*:*:*:*:*:*:* Versions before 072.180.009.07200 Vulnerable ·Xerox
- cpe:2.3:h:xerox:colorqube_9303:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
Remediation
- Fix · CNA ColorQube 9301/9302/9303 (XEROX) Fixed in 072.xxx.009.07200
- Fix · CNA ColorQube 8700/8900 (XEROX) Fixed in 072.xxx.009.07200
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10880
- 2026-10-03 Alias added: GHSA-cp66-c3r7-36c5
- 2026-10-21 EPSS moved to the 95th–99th percentile
- 2026-10-25 EPSS moved to the 90th–95th percentile
- 2026-10-28 EPSS moved to the 95th–99th percentile
References
Sources
- CVE-2019-10880 · CVE Program
- CVE-2019-10880 · NVD
- FIRST EPSS
- GHSA-cp66-c3r7-36c5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences