Read the docs
TI-2024-11609 Aliases CVE-2024-12510GHSA-36fv-6vjc-jf92

LDAP Authentication Sever Pass-back attack

Priority LOW 32CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00967 61st percentileScored 2026-11-07
Fix Fixed Versalink B400 (Xerox): 37.82.53Versalink B405 (Xerox): 38.82.53+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XeroxVersalink B400before 37.82.5337.82.53Patch availableCNA
XeroxVersalink B405before 38.82.5338.82.53Patch availableCNA
XeroxVersalink C400before 67.82.5367.82.53Patch availableCNA
XeroxVersalink C405before 68.82.5368.82.53Patch availableCNA
XeroxVersalink B600/B610before 32.82.5332.82.53Patch availableCNA
XeroxVersalink B605/B615before 33.82.5333.82.53Patch availableCNA
XeroxVersalink C500/C600before 61.82.5361.82.53Patch availableCNA
XeroxVersalink C505/C605before 62.82.5362.82.53Patch availableCNA
XeroxVersalink C7000before 56.75.5356.75.53Patch availableCNA
XeroxVersalink C7020/C7025/C7030before 57.75.5357.75.53Patch availableCNA
XeroxVersalink B7025/B7030/B7035before 58.75.5358.75.53Patch availableCNA
XeroxVersalink B7125/B7130/B7135before 59.24.5359.24.53Patch availableCNA
XeroxVersalink C7120/C7125/C7130before 69.24.5369.24.53Patch availableCNA
XeroxVersalink C8000/C9000before 70.75.5370.75.53Patch availableCNA
XeroxVersalink C8000Wbefore 72.75.5372.75.53Patch availableCNA
XeroxPhaser 6510before 64.75.5364.75.53Patch availableCNA
XeroxWorkCentre 6515before 65.75.5365.75.53Patch availableCNA
  • Versalink B400 VendorXerox Affected before 37.82.53 Fixed in 37.82.53 Patch available CNA
  • Versalink B405 VendorXerox Affected before 38.82.53 Fixed in 38.82.53 Patch available CNA
  • Versalink C400 VendorXerox Affected before 67.82.53 Fixed in 67.82.53 Patch available CNA
  • Versalink C405 VendorXerox Affected before 68.82.53 Fixed in 68.82.53 Patch available CNA
  • Versalink B600/B610 VendorXerox Affected before 32.82.53 Fixed in 32.82.53 Patch available CNA
  • Versalink B605/B615 VendorXerox Affected before 33.82.53 Fixed in 33.82.53 Patch available CNA
  • Versalink C500/C600 VendorXerox Affected before 61.82.53 Fixed in 61.82.53 Patch available CNA
  • Versalink C505/C605 VendorXerox Affected before 62.82.53 Fixed in 62.82.53 Patch available CNA
  • Versalink C7000 VendorXerox Affected before 56.75.53 Fixed in 56.75.53 Patch available CNA
  • Versalink C7020/C7025/C7030 VendorXerox Affected before 57.75.53 Fixed in 57.75.53 Patch available CNA
  • Versalink B7025/B7030/B7035 VendorXerox Affected before 58.75.53 Fixed in 58.75.53 Patch available CNA
  • Versalink B7125/B7130/B7135 VendorXerox Affected before 59.24.53 Fixed in 59.24.53 Patch available CNA
  • Versalink C7120/C7125/C7130 VendorXerox Affected before 69.24.53 Fixed in 69.24.53 Patch available CNA
  • Versalink C8000/C9000 VendorXerox Affected before 70.75.53 Fixed in 70.75.53 Patch available CNA
  • Versalink C8000W VendorXerox Affected before 72.75.53 Fixed in 72.75.53 Patch available CNA
  • Phaser 6510 VendorXerox Affected before 64.75.53 Fixed in 64.75.53 Patch available CNA
  • WorkCentre 6515 VendorXerox Affected before 65.75.53 Fixed in 65.75.53 Patch available CNA

Remediation

  • Fix · CNA Versalink B400 (Xerox) Fixed in 37.82.53
  • Fix · CNA Versalink B405 (Xerox) Fixed in 38.82.53
  • Fix · CNA Versalink C400 (Xerox) Fixed in 67.82.53
  • Fix · CNA Versalink C405 (Xerox) Fixed in 68.82.53
  • Fix · CNA Versalink B600/B610 (Xerox) Fixed in 32.82.53
  • Fix · CNA Versalink B605/B615 (Xerox) Fixed in 33.82.53
  • Fix · CNA Versalink C500/C600 (Xerox) Fixed in 61.82.53
  • Fix · CNA Versalink C505/C605 (Xerox) Fixed in 62.82.53
  • Fix · CNA Versalink C7000 (Xerox) Fixed in 56.75.53
  • Fix · CNA Versalink C7020/C7025/C7030 (Xerox) Fixed in 57.75.53
  • Fix · CNA Versalink B7025/B7030/B7035 (Xerox) Fixed in 58.75.53
  • Fix · CNA Versalink B7125/B7130/B7135 (Xerox) Fixed in 59.24.53
  • Fix · CNA Versalink C7120/C7125/C7130 (Xerox) Fixed in 69.24.53
  • Fix · CNA Versalink C8000/C9000 (Xerox) Fixed in 70.75.53
  • Fix · CNA Versalink C8000W (Xerox) Fixed in 72.75.53
  • Fix · CNA Phaser 6510 (Xerox) Fixed in 64.75.53
  • Fix · CNA WorkCentre 6515 (Xerox) Fixed in 65.75.53

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xerox Phaser 6510, Versalink B400 and 15 more products 32.82.53, 33.82.53 and 15 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-11610 SMB/FTP Address Book Scan Pass-back attackPriority LOW 34
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12510
  2. 2026-10-03 Alias added: GHSA-36fv-6vjc-jf92

References

Other 1

  • TI-2025-07651 Path Traversal leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2008-03418 The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via… CVSS 2.0HIGH 7.8
  • TI-2019-08103 OS command injection in Xerox AltaLink B8045/B8055/B8065/B8075/B8090 CVSS 3.0CRITICAL 9.8
  • TI-2025-07650 XXE leading to SSRF CVSS 3.1HIGH 7.5
  • TI-2026-01898 Path Traversal leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2009-01572 Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632… CVSS 2.0HIGH 10.0
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences