Vulnerability · Published Feb 3, 2025 · Assigned by Xerox
CVE-2024-12511SMB/FTP Address Book Scan Pass-back attack
High 7.6
In plain English
A high-severity missing authentication in Phaser 6510 from Xerox. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.6%top 50.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Xerox | Versalink B400 | 0 – before 37.82.53 |
| Xerox | Versalink B405 | 0 – before 38.82.53 |
| Xerox | Versalink C400 | 0 – before 67.82.53 |
| Xerox | Versalink C405 | 0 – before 68.82.53 |
| Xerox | Versalink B600/B610 | 0 – before 32.82.53 |
| Xerox | Versalink B605/B615 | 0 – before 33.82.53 |
| Xerox | Versalink C500/C600 | 0 – before 61.82.53 |
| Xerox | Versalink C505/C605 | 0 – before 62.82.53 |
| Xerox | Versalink C7000 | 0 – before 56.75.53 |
| Xerox | Versalink C7020/C7025/C7030 | 0 – before 57.75.53 |
| Xerox | Versalink B7025/B7030/B7035 | 0 – before 58.75.53 |
| Xerox | Versalink B7125/B7130/B7135 | 0 – before 59.24.53 |
| Xerox | Versalink C7120/C7125/C7130 | 0 – before 69.24.53 |
| Xerox | Versalink C8000/C9000 | 0 – before 70.75.53 |
| Xerox | Versalink C8000W | 0 – before 72.75.53 |
| Xerox | Phaser 6510 | 0 – before 64.75.53 |
| Xerox | WorkCentre 6515 | 0 – before 65.75.53 |
Weakness: CWE-306, CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L