CVE-2024-6333 - Vulnerability Details

- Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products

Description

Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

Published: 2024-10-17

Score: 7.2 High

EPSS: 3.7% Low

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Xerox

AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 | C8030 / C8035 / C8045 / C8055 / C807

unaffected

Version	Status	Constraints
`103.xxx.024.18600`	affected	—

Xerox

Xerox® EC8036 / EC8056

unaffected

Version	Status	Constraints
`103.xxx.024.18600`	affected	—

Xerox

Xerox® EC8036 / EC8056 - Common Criteria (June 2022)

unaffected

Version	Status	Constraints
`103.023.031.35105`	affected	—

Xerox

Xerox® EC8036 / EC8056 - Common Criteria (June 2024)

unaffected

Version	Status	Constraints
`103.xxx.013.14115`	affected	—

Xerox

AltaLink®C8130 / C8135 / C8145 / C8155 / C8170 | B8145 / B8155 / B8170 Common Criteria (Aug 2024)

unaffected

Version	Status	Constraints
`119.xxx.023.13006`	affected	—

Xerox

AltaLink® C8130 / C8135 / C8145 / C8155 / C8170 | B8145 / B8155 / B8170 Common Criteria Certified (Aug 2023)

unaffected

Version	Status	Constraints
`111.xxx.003.11600`	affected	—

Xerox

VersaLink® B625 / C625 | B425 / C425 Common Criteria Certified (2024)

unaffected

Version	Status	Constraints
`119.xxx.003.11705`	affected	—

Xerox

WorkCentre 3655/3655i

unaffected

Version	Status	Constraints
`075.060.004.07810`	affected	—

Xerox

WorkCentre 5945/55i

unaffected

Version	Status	Constraints
`075.091.004.07810`	affected	—

Xerox

WorkCentre 6655/6655i

unaffected

Version	Status	Constraints
`075.110.004.07810`	affected	—

Xerox

WorkCentre 7220/7225i

unaffected

Version	Status	Constraints
`075.030.004.07810`	affected	—

Xerox

WorkCentre 7830/7835i

unaffected

Version	Status	Constraints
`075.010 004.07810`	affected	—

Xerox

WorkCentre 7845/7855i

unaffected

Version	Status	Constraints
`075.040.004.07810`	affected	—

Xerox

WorkCentre 7845/7855 (IBG)

unaffected

Version	Status	Constraints
`075.080.004.07810`	affected	—

Xerox

WorkCentre 7970/7970i

unaffected

Version	Status	Constraints
`075.200.004.07810`	affected	—

Xerox

WorkCentre EC7836

unaffected

Version	Status	Constraints
`075.050.004.07810`	affected	—

Xerox

WorkCentre EC7856

unaffected

Version	Status	Constraints
`075.020.004.07810`	affected	—

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2024-47447	Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.03669.

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
http://seclists.org/fulldisclosure/2024/Oct/17
https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre-%E2%80%93-CVE-2024-6333-.pdf

History

Wed, 17 Sep 2025 17:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-20

Wed, 17 Sep 2025 17:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-78

Fri, 22 Nov 2024 12:00:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2024/Oct/17

Mon, 21 Oct 2024 20:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Xerox Xerox altalink Firmware Xerox versalink Firmware Xerox workcentre Firmware Xerox xerox Firmware
CPEs		cpe:2.3:o:xerox:altalink_firmware:::::::: cpe:2.3:o:xerox:versalink_firmware:::::::: cpe:2.3:o:xerox:workcentre_firmware:::::::: cpe:2.3:o:xerox:xerox_firmware::::::::
Vendors & Products		Xerox Xerox altalink Firmware Xerox versalink Firmware Xerox workcentre Firmware Xerox xerox Firmware
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 17 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
References	https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-CVE-2024-6333.pdf	https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre-%E2%80%93-CVE-2024-6333-.pdf

Thu, 17 Oct 2024 14:00:00 +0000

Type	Values Removed	Values Added
Description		Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.
Title		Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products
Weaknesses		CWE-20 CWE-77
References		https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox-Security-Bulletin-XRX24-015-for-CVE-2024-6333.pdf
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

Xerox Altalink Firmware Versalink Firmware Workcentre Firmware Xerox Firmware

MITRE

Status: PUBLISHED

Assigner: Xerox

Published: 2024-10-17T13:51:16.011Z

Updated: 2025-09-17T16:52:52.859Z

Reserved: 2024-06-25T18:31:05.065Z

Link: CVE-2024-6333

Vulnrichment

Updated: 2024-10-29T05:02:50.054Z

NVD

Status : Deferred

Published: 2024-10-17T14:15:14.287

Modified: 2026-04-15T00:35:42.020

Link: CVE-2024-6333

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object