CVE & CISA-KEV Catalog

CVE-2016-11061

CRITICALEPSS 78th pctl
9.8
CVSS v3
NVD

Description

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the device.

CWE-78OS Command Injection

How to fix

Remediation Available
workcentre 3655 firmwareNVD
Affected:< 073.060.086.15410Fixed in:073.060.086.15410CVE-2016-11061derived from NVD
workcentre 3655i firmwareNVD
Affected:< 073.060.086.15410Fixed in:073.060.086.15410CVE-2016-11061derived from NVD
workcentre 5865 firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5865i firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5875 firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5875i firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5890 firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5890i firmwareNVD
Affected:< 073.190.086.15410Fixed in:073.190.086.15410CVE-2016-11061derived from NVD
workcentre 5945 firmwareNVD
Affected:< 073.091.086.15410Fixed in:073.091.086.15410CVE-2016-11061derived from NVD
workcentre 5945i firmwareNVD
Affected:< 073.091.086.15410Fixed in:073.091.086.15410CVE-2016-11061derived from NVD
workcentre 5955 firmwareNVD
Affected:< 073.091.086.15410Fixed in:073.091.086.15410CVE-2016-11061derived from NVD
workcentre 5955i firmwareNVD
Affected:< 073.091.086.15410Fixed in:073.091.086.15410CVE-2016-11061derived from NVD
workcentre 6655 firmwareNVD
Affected:< 073.110.086.15410Fixed in:073.110.086.15410CVE-2016-11061derived from NVD
workcentre 6655i firmwareNVD
Affected:< 073.110.086.15410Fixed in:073.110.086.15410CVE-2016-11061derived from NVD
workcentre 7200 firmwareNVD
Affected:< 073.030.086.15410Fixed in:073.030.086.15410CVE-2016-11061derived from NVD
workcentre 7200i firmwareNVD
Affected:< 073.030.086.15410Fixed in:073.030.086.15410CVE-2016-11061derived from NVD
workcentre 7220 firmwareNVD
Affected:< 073.030.086.15410Fixed in:073.030.086.15410CVE-2016-11061derived from NVD
workcentre 7225 firmwareNVD
Affected:< 073.030.086.15410Fixed in:073.030.086.15410CVE-2016-11061derived from NVD
workcentre 7225i firmwareNVD
Affected:< 073.030.086.15410Fixed in:073.030.086.15410CVE-2016-11061derived from NVD
workcentre 7830 firmwareNVD
Affected:< 073.010.086.15410Fixed in:073.010.086.15410CVE-2016-11061derived from NVD
workcentre 7835 firmwareNVD
Affected:< 073.010.086.15410Fixed in:073.010.086.15410CVE-2016-11061derived from NVD
workcentre 7845 firmwareNVD
Affected:< 073.010.086.15410Fixed in:073.010.086.15410CVE-2016-11061derived from NVD
workcentre 7855 firmwareNVD
Affected:< 073.010.086.15410Fixed in:073.010.086.15410CVE-2016-11061derived from NVD
workcentre 7970 firmwareNVD
Affected:< 073.200.086.15410Fixed in:073.200.086.15410CVE-2016-11061derived from NVD
workcentre 7970i firmwareNVD
Affected:< 073.200.086.15410Fixed in:073.200.086.15410CVE-2016-11061derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

1.99%probability of exploitation in 30 days
78thpercentile

Elevated risk: more likely to be exploited than 78% of all known CVEs.

References

Related Vulnerabilities

Other CWE-78 (OS Command Injection) vulnerabilities, ordered by exploit likelihood. View all

CVESeverityCVSSEPSSExploitedFix
CVE-2021-1498Critical9.8100%KEVFix
CVE-2014-6271Critical9.8100%KEVFix
CVE-2019-16920Critical9.8100%KEV-
CVE-2022-44877Critical9.8100%KEVFix
CVE-2020-8515Critical9.8100%KEV-
CVE-2020-9054Critical9.8100%KEVFix
Embed a live status badge for CVE-2016-11061
CVE-2016-11061 severity badge

Markdown

[![CVE-2016-11061](https://tridentstack.com/cve/badge/CVE-2016-11061.svg)](https://tridentstack.com/cve/CVE-2016-11061)

HTML

<a href="https://tridentstack.com/cve/CVE-2016-11061"><img src="https://tridentstack.com/cve/badge/CVE-2016-11061.svg" alt="CVE-2016-11061"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.