Read the docs
TI-2019-14294 Aliases CVE-2019-19832GHSA-6rmg-grv7-3x87

Xerox AltaLink C8035 printers allow CSRF.

Priority LOW 39CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value must have a unique name.)

Why it matters now

EPSS 0.00719 54th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:xerox:altalink_c8035_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableXerox
cpe:2.3:h:xerox:altalink_c8035:-:*:*:*:*:*:*:*not specified by NVDRunning onXerox
  • cpe:2.3:o:xerox:altalink_c8035_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Xerox
  • cpe:2.3:h:xerox:altalink_c8035:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Xerox

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-19832
  2. 2026-10-03 Alias added: GHSA-6rmg-grv7-3x87

References

Exploit 1

  • TI-2018-12272 The web application on Xerox AltaLink B80xx before 100.008.028.05200, C8030/C8035 before… CVSS 3.0CRITICAL 9.8
  • TI-2021-09735 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120… CVSS 3.1CRITICAL 9.8
  • TI-2019-08104 Default hidden Privileged Account Vulnerability in multiple XEROX devices CVSS 3.1CRITICAL 9.8
  • TI-2021-09737 Xerox AltaLink B8045/B8090 before 103.008.030.32000, C8030/C8035 before… CVSS 3.1CRITICAL 9.1
  • TI-2019-13472 Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070… CVSS 3.1HIGH 8.1
  • TI-2021-09736 Xerox AltaLink B80xx before 103.008.020.23120, C8030/C8035 before 103.001.020.23120… CVSS 3.1HIGH 7.5
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences