Read the docs
TI-2024-11610 Aliases CVE-2024-12511GHSA-33gq-q699-4w29

SMB/FTP Address Book Scan Pass-back attack

Priority LOW 34CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
High · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306 and CWE-522.

Summary

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00622 50th percentileScored 2026-11-07
Fix Fixed Versalink B400 (Xerox): 37.82.53Versalink B405 (Xerox): 38.82.53+15 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XeroxVersalink B400before 37.82.5337.82.53Patch availableCNA
XeroxVersalink B405before 38.82.5338.82.53Patch availableCNA
XeroxVersalink C400before 67.82.5367.82.53Patch availableCNA
XeroxVersalink C405before 68.82.5368.82.53Patch availableCNA
XeroxVersalink B600/B610before 32.82.5332.82.53Patch availableCNA
XeroxVersalink B605/B615before 33.82.5333.82.53Patch availableCNA
XeroxVersalink C500/C600before 61.82.5361.82.53Patch availableCNA
XeroxVersalink C505/C605before 62.82.5362.82.53Patch availableCNA
XeroxVersalink C7000before 56.75.5356.75.53Patch availableCNA
XeroxVersalink C7020/C7025/C7030before 57.75.5357.75.53Patch availableCNA
XeroxVersalink B7025/B7030/B7035before 58.75.5358.75.53Patch availableCNA
XeroxVersalink B7125/B7130/B7135before 59.24.5359.24.53Patch availableCNA
XeroxVersalink C7120/C7125/C7130before 69.24.5369.24.53Patch availableCNA
XeroxVersalink C8000/C9000before 70.75.5370.75.53Patch availableCNA
XeroxVersalink C8000Wbefore 72.75.5372.75.53Patch availableCNA
XeroxPhaser 6510before 64.75.5364.75.53Patch availableCNA
XeroxWorkCentre 6515before 65.75.5365.75.53Patch availableCNA
  • Versalink B400 VendorXerox Affected before 37.82.53 Fixed in 37.82.53 Patch available CNA
  • Versalink B405 VendorXerox Affected before 38.82.53 Fixed in 38.82.53 Patch available CNA
  • Versalink C400 VendorXerox Affected before 67.82.53 Fixed in 67.82.53 Patch available CNA
  • Versalink C405 VendorXerox Affected before 68.82.53 Fixed in 68.82.53 Patch available CNA
  • Versalink B600/B610 VendorXerox Affected before 32.82.53 Fixed in 32.82.53 Patch available CNA
  • Versalink B605/B615 VendorXerox Affected before 33.82.53 Fixed in 33.82.53 Patch available CNA
  • Versalink C500/C600 VendorXerox Affected before 61.82.53 Fixed in 61.82.53 Patch available CNA
  • Versalink C505/C605 VendorXerox Affected before 62.82.53 Fixed in 62.82.53 Patch available CNA
  • Versalink C7000 VendorXerox Affected before 56.75.53 Fixed in 56.75.53 Patch available CNA
  • Versalink C7020/C7025/C7030 VendorXerox Affected before 57.75.53 Fixed in 57.75.53 Patch available CNA
  • Versalink B7025/B7030/B7035 VendorXerox Affected before 58.75.53 Fixed in 58.75.53 Patch available CNA
  • Versalink B7125/B7130/B7135 VendorXerox Affected before 59.24.53 Fixed in 59.24.53 Patch available CNA
  • Versalink C7120/C7125/C7130 VendorXerox Affected before 69.24.53 Fixed in 69.24.53 Patch available CNA
  • Versalink C8000/C9000 VendorXerox Affected before 70.75.53 Fixed in 70.75.53 Patch available CNA
  • Versalink C8000W VendorXerox Affected before 72.75.53 Fixed in 72.75.53 Patch available CNA
  • Phaser 6510 VendorXerox Affected before 64.75.53 Fixed in 64.75.53 Patch available CNA
  • WorkCentre 6515 VendorXerox Affected before 65.75.53 Fixed in 65.75.53 Patch available CNA

Remediation

  • Fix · CNA Versalink B400 (Xerox) Fixed in 37.82.53
  • Fix · CNA Versalink B405 (Xerox) Fixed in 38.82.53
  • Fix · CNA Versalink C400 (Xerox) Fixed in 67.82.53
  • Fix · CNA Versalink C405 (Xerox) Fixed in 68.82.53
  • Fix · CNA Versalink B600/B610 (Xerox) Fixed in 32.82.53
  • Fix · CNA Versalink B605/B615 (Xerox) Fixed in 33.82.53
  • Fix · CNA Versalink C500/C600 (Xerox) Fixed in 61.82.53
  • Fix · CNA Versalink C505/C605 (Xerox) Fixed in 62.82.53
  • Fix · CNA Versalink C7000 (Xerox) Fixed in 56.75.53
  • Fix · CNA Versalink C7020/C7025/C7030 (Xerox) Fixed in 57.75.53
  • Fix · CNA Versalink B7025/B7030/B7035 (Xerox) Fixed in 58.75.53
  • Fix · CNA Versalink B7125/B7130/B7135 (Xerox) Fixed in 59.24.53
  • Fix · CNA Versalink C7120/C7125/C7130 (Xerox) Fixed in 69.24.53
  • Fix · CNA Versalink C8000/C9000 (Xerox) Fixed in 70.75.53
  • Fix · CNA Versalink C8000W (Xerox) Fixed in 72.75.53
  • Fix · CNA Phaser 6510 (Xerox) Fixed in 64.75.53
  • Fix · CNA WorkCentre 6515 (Xerox) Fixed in 65.75.53

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Xerox Phaser 6510, Versalink B400 and 15 more products 32.82.53, 33.82.53 and 15 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2024-11609 LDAP Authentication Sever Pass-back attackPriority LOW 32
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12511
  2. 2026-10-03 Alias added: GHSA-33gq-q699-4w29
  3. 2026-11-07 EPSS moved to the 50th–90th percentile

References

Other 1

  • TI-2025-07651 Path Traversal leading to RCE CVSS 3.1CRITICAL 9.8
  • TI-2008-03418 The Xerox Phaser 8400 allows remote attackers to cause a denial of service (reboot) via… CVSS 2.0HIGH 7.8
  • TI-2019-08103 OS command injection in Xerox AltaLink B8045/B8055/B8065/B8075/B8090 CVSS 3.0CRITICAL 9.8
  • TI-2025-07650 XXE leading to SSRF CVSS 3.1HIGH 7.5
  • TI-2026-01898 Path Traversal leading to Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
  • TI-2009-01572 Xerox WorkCentre and WorkCentre Pro 232, 238, 245, 255, 265, 275; and WorkCentre 5632… CVSS 2.0HIGH 10.0
See all 123 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences