Default hidden Privileged Account Vulnerability in multiple XEROX devices
Priority MEDIUM 44CWE-259Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-259.
Summary
Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled.
Why it matters now
EPSS 0.01095 65th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Xerox | AltaLink B8045/B8055/B8065/B8075/B8090 | all versions | — | No fix listed | CNA |
| Xerox | AltaLink C8030/C8035/C8045/C8055/C8070 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 3655 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 5845/5855/5865/5875/5890 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 5945/5955 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 6655 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 7220/7225 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 7830/7835/7845/7855 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 7970 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre EC7836/EC7856 | all versions | — | No fix listed | CNA |
| Xerox | ColorQube 9301/9302/9303 | all versions | — | No fix listed | CNA |
| Xerox | ColorQube 8700/8900 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 6400 | all versions | — | No fix listed | CNA |
| Xerox | Phaser 6700 | all versions | — | No fix listed | CNA |
| Xerox | Phaser 7800 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 5735/5740/5745/5755/5765/5775/5790 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 7525/7530/7535/7545/7556 | all versions | — | No fix listed | CNA |
| Xerox | WorkCentre 7755/7765/7775 | all versions | — | No fix listed | CNA |
- AltaLink B8045/B8055/B8065/B8075/B8090 VendorXerox Affected all versions Fixed in — No fix listed CNA
- AltaLink C8030/C8035/C8045/C8055/C8070 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 3655 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 5845/5855/5865/5875/5890 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 5945/5955 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 6655 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 7220/7225 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 7830/7835/7845/7855 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 7970 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre EC7836/EC7856 VendorXerox Affected all versions Fixed in — No fix listed CNA
- ColorQube 9301/9302/9303 VendorXerox Affected all versions Fixed in — No fix listed CNA
- ColorQube 8700/8900 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 6400 VendorXerox Affected all versions Fixed in — No fix listed CNA
- Phaser 6700 VendorXerox Affected all versions Fixed in — No fix listed CNA
- Phaser 7800 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 5735/5740/5745/5755/5765/5775/5790 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 7525/7530/7535/7545/7556 VendorXerox Affected all versions Fixed in — No fix listed CNA
- WorkCentre 7755/7765/7775 VendorXerox Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 20
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:xerox:altalink_b8045_firmware:*:*:*:*:*:*:*:* | before 103.008.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_b8045:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_b8055_firmware:*:*:*:*:*:*:*:* | before 103.008.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_b8055:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_b8065_firmware:*:*:*:*:*:*:*:* | before 103.008.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_b8065:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_b8075_firmware:*:*:*:*:*:*:*:* | before 103.008.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_b8075:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_b8090_firmware:*:*:*:*:*:*:*:* | before 103.008.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_b8090:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
- cpe:2.3:o:xerox:altalink_b8045_firmware:*:*:*:*:*:*:*:* Versions before 103.008.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_b8045:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_b8055_firmware:*:*:*:*:*:*:*:* Versions before 103.008.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_b8055:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_b8065_firmware:*:*:*:*:*:*:*:* Versions before 103.008.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_b8065:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_b8075_firmware:*:*:*:*:*:*:*:* Versions before 103.008.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_b8075:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_b8090_firmware:*:*:*:*:*:*:*:* Versions before 103.008.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_b8090:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
Show 10 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:xerox:altalink_c8030_firmware:*:*:*:*:*:*:*:* | before 103.001.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_c8030:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_c8035_firmware:*:*:*:*:*:*:*:* | before 103.001.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_c8035:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_c8045_firmware:*:*:*:*:*:*:*:* | before 103.002.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_c8045:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_c8055_firmware:*:*:*:*:*:*:*:* | before 103.002.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_c8055:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
| cpe:2.3:o:xerox:altalink_c8070_firmware:*:*:*:*:*:*:*:* | before 103.003.010.14010 | Vulnerable | Xerox |
| cpe:2.3:h:xerox:altalink_c8070:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Xerox |
- cpe:2.3:o:xerox:altalink_c8030_firmware:*:*:*:*:*:*:*:* Versions before 103.001.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_c8030:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_c8035_firmware:*:*:*:*:*:*:*:* Versions before 103.001.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_c8035:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_c8045_firmware:*:*:*:*:*:*:*:* Versions before 103.002.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_c8045:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_c8055_firmware:*:*:*:*:*:*:*:* Versions before 103.002.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_c8055:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
- cpe:2.3:o:xerox:altalink_c8070_firmware:*:*:*:*:*:*:*:* Versions before 103.003.010.14010 Vulnerable ·Xerox
- cpe:2.3:h:xerox:altalink_c8070:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10881
- 2026-10-03 Alias added: GHSA-vcm3-phm4-6c23
References
More Xerox Altalink B8045 Firmware vulnerabilities
- TI-2018-12272 The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before… CVSS 3.0CRITICAL 9.8
- TI-2021-09735 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120… CVSS 3.1CRITICAL 9.8
- TI-2021-09737 Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before… CVSS 3.1CRITICAL 9.1
- TI-2019-13472 Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070… CVSS 3.1HIGH 8.1
- TI-2021-09736 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120… CVSS 3.1HIGH 7.5
- TI-2019-13473 On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070… CVSS 3.1HIGH 7.5
Sources
- CVE-2019-10881 · CVE Program
- CVE-2019-10881 · NVD
- FIRST EPSS
- GHSA-vcm3-phm4-6c23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences