Skip to content
Fencer Vulns
high 7.2

CVE-2024-6333 json

Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products

published 2024-10-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-47447

cvss
7.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

Patch / fix

  • xerox altalink_firmware 103.xxx.024.18600, 111.xxx.003.11600, 119.xxx.023.13006
  • xerox versalink_firmware 119.xxx.003.11705
  • xerox workcentre_firmware 075.010 004.07810, 075.020.004.07810, 075.030.004.07810, 075.040.004.07810, 075.050.004.07810, 075.060.004.07810, 075.080.004.07810, 075.091.004.07810, 075.110.004.07810, 075.200.004.07810
  • xerox xerox_firmware 103.023.031.35105, 103.xxx.013.14115, 103.xxx.024.18600

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Xerox AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 | C8030 / C8035 / C8045 / C8055 / C807
  • Xerox Xerox® EC8036 / EC8056
  • Xerox Xerox® EC8036 / EC8056 - Common Criteria (June 2022)
  • Xerox Xerox® EC8036 / EC8056 - Common Criteria (June 2024)
  • Xerox AltaLink®C8130 / C8135 / C8145 / C8155 / C8170 | B8145 / B8155 / B8170 Common Criteria (Aug 2024)
  • Xerox AltaLink® C8130 / C8135 / C8145 / C8155 / C8170 | B8145 / B8155 / B8170 Common Criteria Certified (Aug 2023)
  • Xerox VersaLink® B625 / C625 | B425 / C425 Common Criteria Certified (2024)
  • Xerox WorkCentre 3655/3655i
  • Xerox WorkCentre 5945/55i
  • Xerox WorkCentre 6655/6655i
  • Xerox WorkCentre 7220/7225i
  • Xerox WorkCentre 7830/7835i
  • Xerox WorkCentre 7845/7855i
  • Xerox WorkCentre 7845/7855 (IBG)
  • Xerox WorkCentre 7970/7970i
  • Xerox WorkCentre EC7836
  • Xerox WorkCentre EC7856
  • xerox altalink_firmware
  • xerox versalink_firmware
  • xerox workcentre_firmware
  • xerox xerox_firmware

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.