What’s Vulnerable › Vulnerabilities

CVE-2021-28671

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-29 · updated 2026-06-17

Description

Xerox Phaser 6510 before 64.65.51 and 64.59.11 (Bridge), WorkCentre 6515 before 65.65.51 and 65.59.11 (Bridge), VersaLink B400 before 37.65.51 and 37.59.01 (Bridge), B405 before 38.65.51 and 38.59.01 (Bridge), B600/B610 before 32.65.51 and 32.59.01 (Bridge), B605/B615 before 33.65.51 and 33.59.01 (Bridge), B7025/30/35 before 58.65.51 and 58.59.11 (Bridge), C400 before 67.65.51 and 67.59.01 (Bridge), C405 before 68.65.51 and 68.59.01 (Bridge), C500/C600 before 61.65.51 and 61.59.01 (Bridge), C505/C605 before 62.65.51 and 62.59.01 (Bridge), C7000 before 56.65.51 and 56.59.01 (Bridge), C7020/25/30 before 57.65.51 and 57.59.01 (Bridge), C8000/C9000 before 70.65.51 and 70.59.01 (Bridge), C8000W before 72.65.51 have a remote Command Execution vulnerability in the Web User Interface that allows remote attackers with "a weaponized clone file" to execute arbitrary commands.

Affected products

• Xerox Phaser 6510 Firmware: before 64.59.11; before 64.65.51 — fixed in 64.59.11, 64.65.51
• Xerox Versalink B400 Firmware: before 37.59.01; before 37.65.51 — fixed in 37.59.01, 37.65.51
• Xerox Versalink B405 Firmware: before 38.59.01; before 38.65.51 — fixed in 38.59.01, 38.65.51
• Xerox Versalink B600 Firmware: before 32.59.01; before 32.65.51 — fixed in 32.59.01, 32.65.51
• Xerox Versalink B605 Firmware: before 33.59.01; before 33.65.51 — fixed in 33.59.01, 33.65.51
• Xerox Versalink B610 Firmware: before 32.59.01; before 32.65.51 — fixed in 32.59.01, 32.65.51
• Xerox Versalink B615 Firmware: before 33.59.01; before 33.65.51 — fixed in 33.59.01, 33.65.51
• Xerox Versalink B7025 Firmware: before 58.59.11; before 58.65.51 — fixed in 58.59.11, 58.65.51
• Xerox Versalink B7030 Firmware: before 58.59.11; before 58.65.51 — fixed in 58.59.11, 58.65.51
• Xerox Versalink B7035 Firmware: before 58.59.11; before 58.65.51 — fixed in 58.59.11, 58.65.51
• Xerox Versalink C400 Firmware: before 67.59.01; before 67.65.51 — fixed in 67.59.01, 67.65.51
• Xerox Versalink C405 Firmware: before 68.59.01; before 68.65.51 — fixed in 68.59.01, 68.65.51
• Xerox Versalink C500 Firmware: before 61.59.01; before 61.65.51 — fixed in 61.59.01, 61.65.51
• Xerox Versalink C505 Firmware: before 62.59.01; before 62.65.51 — fixed in 62.59.01, 62.65.51
• Xerox Versalink C600 Firmware: before 61.59.01; before 61.65.51 — fixed in 61.59.01, 61.65.51
• Xerox Versalink C605 Firmware: before 62.59.01; before 62.65.51 — fixed in 62.59.01, 62.65.51
• Xerox Versalink C7000 Firmware: before 56.59.01; before 56.65.51 — fixed in 56.59.01, 56.65.51
• Xerox Versalink C7020 Firmware: before 57.59.01; before 57.65.51 — fixed in 57.59.01, 57.65.51
• Xerox Versalink C7025 Firmware: before 57.59.01; before 57.65.51 — fixed in 57.59.01, 57.65.51
• Xerox Versalink C7030 Firmware: before 57.59.01; before 57.65.51 — fixed in 57.59.01, 57.65.51
• Xerox Versalink C8000 Firmware: before 70.59.01; before 70.65.51 — fixed in 70.59.01, 70.65.51
• Xerox Versalink C8000W Firmware: before 72.65.51 — fixed in 72.65.51
• Xerox Versalink C9000 Firmware: before 70.59.01; before 70.65.51 — fixed in 70.59.01, 70.65.51
• Xerox Workcentre 6515 Firmware: before 65.59.11; before 65.65.51 — fixed in 65.59.11, 65.65.51

How to fix

Upgrade to a fixed version: Xerox Phaser 6510 Firmware 64.59.11, 64.65.51; Xerox Versalink B400 Firmware 37.59.01, 37.65.51; Xerox Versalink B405 Firmware 38.59.01, 38.65.51; Xerox Versalink B600 Firmware 32.59.01, 32.65.51; Xerox Versalink B605 Firmware 33.59.01, 33.65.51; Xerox Versalink B610 Firmware 32.59.01, 32.65.51; Xerox Versalink B615 Firmware 33.59.01, 33.65.51; Xerox Versalink B7025 Firmware 58.59.11, 58.65.51; Xerox Versalink B7030 Firmware 58.59.11, 58.65.51; Xerox Versalink B7035 Firmware 58.59.11, 58.65.51; Xerox Versalink C400 Firmware 67.59.01, 67.65.51; Xerox Versalink C405 Firmware 68.59.01, 68.65.51. Check the vendor advisory for mitigations.

References

• https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf
• https://securitydocs.business.xerox.com/wp-content/uploads/2021/03/cert_Security_Mini_Bulletin_XRX21D_for_PH6510_WC6515_VersaLink-1.pdf

Get alerted when CVE-2021-28671 or the next vulnerability affects your stack