Xerox WorkCentre Printer prior 073.xxx.000.02300 LDAP insufficiently protected credentials

Summaryinfo

A vulnerability described as critical has been identified in Xerox WorkCentre Printer. This vulnerability affects unknown code of the component LDAP Handler. Such manipulation leads to insufficiently protected credentials. This vulnerability is listed as CVE-2020-9330. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Xerox WorkCentre Printer (Printing Software). Affected by this issue is an unknown code block of the component LDAP Handler. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. Using CWE to declare the problem leads to CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP address to a system owned by the actor without knowledge of the LDAP bind credentials. After changing the LDAP connection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Directory) credentials to the actor. Although the credentials may belong to a non-privileged user, organizations frequently use privileged service accounts to bind to Active Directory. The attacker gains a foothold on the Active Directory domain at a minimum, and may use the credentials to take over control of the Active Directory domain. This affects 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**, 72XX*, 72XXi*, 78XX**, 78XXi**, 7970**, 7970i**, EC7836**, and EC7856** devices.

The weakness was presented 02/21/2020. This vulnerability is handled as CVE-2020-9330 since 02/21/2020. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1552.

Upgrading to version 073.xxx.000.02300 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Printing Software

Vendor

• Xerox

Name

• WorkCentre Printer

License

• commercial

Website

• Vendor: https://www.xerox.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion