Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted…

published 2019-04-12 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-2602

cvss: 9.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 8.5%; EPSS 8.5% chance of exploitation in 30 days, percentile 95%
public exploits: 0; none known

Within multiple XEROX products a vulnerability allows remote command execution on the Linux system, as the "nobody" user through a crafted "HTTP" request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.

Patch / fix

fixed in 2

XEROX ColorQube 9301/9302/9303 072.xxx.009.07200
XEROX ColorQube 8700/8900 072.xxx.009.07200

Exploit prediction

8.47% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

XEROX AltaLink B8045/B8055/B8065/B8075/B8090
XEROX AltaLink C8030/C8035/C8045/C8055/C8070
XEROX WorkCentre 3655
XEROX WorkCentre 5845/5855/5865/5875/5890
XEROX WorkCentre 5945/5955
XEROX WorkCentre 6655
XEROX WorkCentre 7220/7225
XEROX WorkCentre 7830/7835/7845/7855
XEROX WorkCentre 7970
XEROX WorkCentre EC7836/EC7856
XEROX ColorQube 9301/9302/9303
XEROX ColorQube 8700/8900
XEROX WorkCentre 6400
XEROX Phaser 6700
XEROX Phaser 7800
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790
XEROX WorkCentre 7525/7530/7535/7545/7556
XEROX WorkCentre 7755/7765/7775

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

securitydocs.business.xerox.com /wp-content/uploads/2019/04/cert_Security_Mini_Bulletin_XRX19C_for_CQ8700_CQ8900_CQ93xx.pdf
vendor-advisory
airbus-seclab.github.io /
not-applicable

Sources

CVE List CVE-2019-10880
NVD CVE-2019-10880

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary