Quantum Secular Labs / Blog / Advisories

CVE-2018-16709: Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271…

CVE-2018-16709 is rated critical with a CVSS v3.0 base score of 9.8 and NVD lists 9 affected products, including Fujixerox Docucentre V 3065 Firmware. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Fuji Xerox DocuCentre-V 3065, ApeosPort-VI C3371, ApeosPort-V C4475, ApeosPort-V C3375, DocuCentre-VI C2271, ApeosPort-V C5576, DocuCentre-IV C2263, DocuCentre-V C2263, and ApeosPort-V 5070 devices allow remote attackers to read or write to files via crafted PJL commands.

Severity breakdown

CVSS v3.0 9.8: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Unchanged. Impact stays within the vulnerable component.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

  • Fujixerox Docucentre V 3065 Firmware: all versions listed by NVD
  • Fujixerox Apeosport V C4475 Firmware: all versions listed by NVD
  • Fujixerox Apeosport Vi C3371 Firmware: all versions listed by NVD
  • Fujixerox Apeosport V C3375 Firmware: all versions listed by NVD
  • Fujixerox Docucentre Vi C2271 Firmware: all versions listed by NVD
  • Fujixerox Apeosport V C5576 Firmware: all versions listed by NVD
  • Fujixerox Docucentre Iv C2263 Firmware: all versions listed by NVD
  • Fujixerox Docucentre V C2263 Firmware: all versions listed by NVD
  • Fujixerox Apeosport V 5070 Firmware: all versions listed by NVD

References