CVE-2016-11061

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

• xerox workcentre 3655 firmware (< 073.060.086.15410) • xerox workcentre 3655i firmware (< 073.060.086.15410) • xerox workcentre 5865 firmware (< 073.190.086.15410) • xerox workcentre 5875 firmware (< 073.190.086.15410) • xerox workcentre 5890 firmware (< 073.190.086.15410) • xerox workcentre 5865i firmware (< 073.190.086.15410) • xerox workcentre 5875i firmware (< 073.190.086.15410) • xerox workcentre 5890i firmware (< 073.190.086.15410) • xerox workcentre 5945 firmware (< 073.091.086.15410) • xerox workcentre 5955 firmware (< 073.091.086.15410) • xerox workcentre 5945i firmware (< 073.091.086.15410) • xerox workcentre 5955i firmware (< 073.091.086.15410) • xerox workcentre 6655 firmware (< 073.110.086.15410) • xerox workcentre 6655i firmware (< 073.110.086.15410) • xerox workcentre 7200 firmware (< 073.030.086.15410) • xerox workcentre 7200i firmware (< 073.030.086.15410) • xerox workcentre 7225i firmware (< 073.030.086.15410) • xerox workcentre 7830 firmware (< 073.010.086.15410) • xerox workcentre 7835 firmware (< 073.010.086.15410) • xerox workcentre 7845 firmware (< 073.010.086.15410) • xerox workcentre 7855 firmware (< 073.010.086.15410) • xerox workcentre 7970 firmware (< 073.200.086.15410) • xerox workcentre 7970i firmware (< 073.200.086.15410) • xerox workcentre 7225 firmware (< 073.030.086.15410) • xerox workcentre 7220 firmware (< 073.030.086.15410)