What’s Vulnerable › Vulnerabilities

CVE-2016-11061

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-29 · updated 2026-06-17
• Weakness: CWE-78

Description

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

Affected products

• Xerox Workcentre 3655 Firmware: before 073.060.086.15410 — fixed in 073.060.086.15410
• Xerox Workcentre 3655I Firmware: before 073.060.086.15410 — fixed in 073.060.086.15410
• Xerox Workcentre 5865 Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5865I Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5875 Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5875I Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5890 Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5890I Firmware: before 073.190.086.15410 — fixed in 073.190.086.15410
• Xerox Workcentre 5945 Firmware: before 073.091.086.15410 — fixed in 073.091.086.15410
• Xerox Workcentre 5945I Firmware: before 073.091.086.15410 — fixed in 073.091.086.15410
• Xerox Workcentre 5955 Firmware: before 073.091.086.15410 — fixed in 073.091.086.15410
• Xerox Workcentre 5955I Firmware: before 073.091.086.15410 — fixed in 073.091.086.15410
• Xerox Workcentre 6655 Firmware: before 073.110.086.15410 — fixed in 073.110.086.15410
• Xerox Workcentre 6655I Firmware: before 073.110.086.15410 — fixed in 073.110.086.15410
• Xerox Workcentre 7200 Firmware: before 073.030.086.15410 — fixed in 073.030.086.15410
• Xerox Workcentre 7200I Firmware: before 073.030.086.15410 — fixed in 073.030.086.15410
• Xerox Workcentre 7220 Firmware: before 073.030.086.15410 — fixed in 073.030.086.15410
• Xerox Workcentre 7225 Firmware: before 073.030.086.15410 — fixed in 073.030.086.15410
• Xerox Workcentre 7225I Firmware: before 073.030.086.15410 — fixed in 073.030.086.15410
• Xerox Workcentre 7830 Firmware: before 073.010.086.15410 — fixed in 073.010.086.15410
• Xerox Workcentre 7835 Firmware: before 073.010.086.15410 — fixed in 073.010.086.15410
• Xerox Workcentre 7845 Firmware: before 073.010.086.15410 — fixed in 073.010.086.15410
• Xerox Workcentre 7855 Firmware: before 073.010.086.15410 — fixed in 073.010.086.15410
• Xerox Workcentre 7970 Firmware: before 073.200.086.15410 — fixed in 073.200.086.15410
• Xerox Workcentre 7970I Firmware: before 073.200.086.15410 — fixed in 073.200.086.15410

How to fix

Upgrade to a fixed version: Xerox Workcentre 3655 Firmware 073.060.086.15410; Xerox Workcentre 3655I Firmware 073.060.086.15410; Xerox Workcentre 5865 Firmware 073.190.086.15410; Xerox Workcentre 5865I Firmware 073.190.086.15410; Xerox Workcentre 5875 Firmware 073.190.086.15410; Xerox Workcentre 5875I Firmware 073.190.086.15410; Xerox Workcentre 5890 Firmware 073.190.086.15410; Xerox Workcentre 5890I Firmware 073.190.086.15410; Xerox Workcentre 5945 Firmware 073.091.086.15410; Xerox Workcentre 5945I Firmware 073.091.086.15410; Xerox Workcentre 5955 Firmware 073.091.086.15410; Xerox Workcentre 5955I Firmware 073.091.086.15410. Check the vendor advisory for mitigations.

References

• https://securitydocs.business.xerox.com/wp-content/uploads/2016/10/cert_Mini_Security_Bulletin_XRX16Q_for_ConnectKey_R16-05_v1-1-2.pdf
• https://securitydocs.business.xerox.com/wp-content/uploads/2016/10/cert_Mini_Security_Bulletin_XRX16Q_for_ConnectKey_R16-05_v1-1-2.pdf

Get alerted when CVE-2016-11061 or the next vulnerability affects your stack