Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

BID:12783

Info

Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

Bugtraq ID: 12783
Class: Access Validation Error
CVE: CVE-2005-1936
Remote: Yes
Local: No
Published: Mar 11 2005 12:00AM
Updated: Jul 12 2009 10:56AM
Credit: Discovery is credited to Juha-Matti Laurio.
Vulnerable: Xerox WorkCentre Pro 90 1.001.02.084
Xerox WorkCentre Pro 90 1.001.00.060
Xerox WorkCentre Pro 90
Xerox WorkCentre Pro 75 1.001.02.084
Xerox WorkCentre Pro 75 1.001.00.060
Xerox WorkCentre Pro 75
Xerox WorkCentre Pro 65 1.001.02.084
Xerox WorkCentre Pro 65 1.001.00.060
Xerox WorkCentre Pro 65
Xerox WorkCentre Pro 55 3.97.20.032
Xerox WorkCentre Pro 55 3.028.11.000
Xerox WorkCentre Pro 55 1.02.378.1
Xerox WorkCentre Pro 55 1.02.353.1
Xerox WorkCentre Pro 55 1.01.108.1
Xerox WorkCentre Pro 55
Xerox WorkCentre Pro 45 3.97.20.032
Xerox WorkCentre Pro 45 3.028.11.000
Xerox WorkCentre Pro 45 1.02.378.1
Xerox WorkCentre Pro 45 1.02.353.1
Xerox WorkCentre Pro 45 1.01.108.1
Xerox WorkCentre Pro 45
Xerox WorkCentre Pro 40 Color
Xerox WorkCentre Pro 35 3.97.20.032
Xerox WorkCentre Pro 35 3.028.11.000
Xerox WorkCentre Pro 35 1.02.378.1
Xerox WorkCentre Pro 35 1.02.353.1
Xerox WorkCentre Pro 35 1.01.108.1
Xerox WorkCentre Pro 35
Xerox WorkCentre Pro 32 Color
Xerox WorkCentre M55 4.84.16.000
Xerox WorkCentre M55 2.97.20.032
Xerox WorkCentre M55 2.028.11.000
Xerox WorkCentre M55 1.02.378.1
Xerox WorkCentre M55 1.02.353.1
Xerox WorkCentre M55 1.01.108.1
Xerox WorkCentre M55
Xerox WorkCentre M45 4.84.16.000
Xerox WorkCentre M45 2.97.20.032
Xerox WorkCentre M45 2.028.11.000
Xerox WorkCentre M45 1.02.378.1
Xerox WorkCentre M45 1.02.353.1
Xerox WorkCentre M45 1.01.108.1
Xerox WorkCentre M45
Xerox WorkCentre M35 4.84.16.000
Xerox WorkCentre M35 2.97.20.032
Xerox WorkCentre M35 2.028.11.000
Xerox WorkCentre M35 1.02.378.1
Xerox WorkCentre M35 1.02.353.1
Xerox WorkCentre M35 1.01.108.1
Xerox WorkCentre M35
Xerox WorkCentre 90 1.02.028.3
Xerox WorkCentre 90 1.001.02.076.1
Xerox WorkCentre 90 1.001.00.060
Xerox WorkCentre 90 1.00.60.3
Xerox WorkCentre 75 1.02.028.3
Xerox WorkCentre 75 1.001.02.076.1
Xerox WorkCentre 75 1.001.00.060
Xerox WorkCentre 75 1.00.60.3
Xerox WorkCentre 65 1.02.028.3
Xerox WorkCentre 65 1.001.02.076.1
Xerox WorkCentre 65 1.001.00.060
Xerox WorkCentre 65 1.00.60.3
Xerox WorkCentre 40 Color 1.00.060
Xerox WorkCentre 40 Color 01.02.077.1
Xerox WorkCentre 40 Color 01.02.053.1
Xerox WorkCentre 32 Color 1.00.060
Xerox WorkCentre 32 Color 01.02.077.1
Xerox WorkCentre 32 Color 01.02.053.1
Xerox Document Centre 555
Xerox Document Centre 545
Xerox Document Centre 535
Xerox Document Centre 490
Xerox Document Centre 480
Xerox Document Centre 470
Xerox Document Centre 460
Xerox Document Centre 440
Xerox Document Centre 432
Xerox Document Centre 430
Xerox Document Centre 426
Xerox Document Centre 425
Xerox Document Centre 420
Xerox Document Centre 340
Xerox Document Centre 332
Xerox Document Centre 265
Xerox Document Centre 255
Xerox Document Centre 240
Xerox Document Centre 230
Xerox Document Centre 220
Not Vulnerable:

Discussion

Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

A remote authentication bypass vulnerability affects Xerox Document Centre. This issue is due to a failure of the application to properly handle access credentials.

An attacker may leverage this issue to gain unauthorized access to the device configuration interface. It should be noted that access to user accounts on the affected device is not granted through exploitation of this issue.

Exploit / POC

Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

Solution:
The vendor has released SECURITY BULLETIN XRX05-003, XRX04-009, and XRX04-001 with fixes dealing with this issue. Please see the referenced advisories for more information in regarding to obtaining and applying appropriate fixes.

Xerox has released an advisory (XRX05-007) to address multiple issues. This advisory includes a cumulative patch (cert_P23_HTTP_Patch_AllWCP.zip) for several issues in Xerox MicroServer Web Server included with Xerox WorkCentre and WorkCentre Pro products. Please see the referenced advisory for further information.


Xerox WorkCentre Pro 75 1.001.00.060

Xerox WorkCentre Pro 90

Xerox WorkCentre M35

Xerox WorkCentre Pro 35 3.028.11.000

Xerox WorkCentre M45 4.84.16.000

Xerox WorkCentre Pro 45 1.02.378.1

Xerox WorkCentre 40 Color 01.02.077.1

Xerox WorkCentre M35 1.02.378.1

Xerox WorkCentre Pro 35

Xerox WorkCentre Pro 32 Color

Xerox Document Centre 470

Xerox WorkCentre M45 2.97.20.032

Xerox WorkCentre M35 2.97.20.032

Xerox WorkCentre Pro 75 1.001.02.084

Xerox WorkCentre Pro 65 1.001.02.084

Xerox Document Centre 440

Xerox Document Centre 490

Xerox WorkCentre 90 1.001.00.060

Xerox Document Centre 460

Xerox WorkCentre M55 1.01.108.1

Xerox Document Centre 240

Xerox WorkCentre 65 1.001.02.076.1

Xerox WorkCentre Pro 55 3.028.11.000

Xerox WorkCentre 32 Color 01.02.053.1

Xerox Document Centre 255

Xerox WorkCentre 90 1.02.028.3

Xerox WorkCentre Pro 65 1.001.00.060

Xerox WorkCentre M55

Xerox WorkCentre 90 1.00.60.3

Xerox WorkCentre 75 1.00.60.3

Xerox Document Centre 555

Xerox WorkCentre M55 2.97.20.032

Xerox WorkCentre 75 1.02.028.3

Xerox Document Centre 420

Xerox WorkCentre M35 1.01.108.1

Xerox WorkCentre Pro 55

Xerox WorkCentre Pro 90 1.001.00.060

Xerox WorkCentre Pro 45 3.97.20.032

Xerox WorkCentre Pro 75

Xerox WorkCentre M35 2.028.11.000

Xerox Document Centre 265

Xerox WorkCentre M45

Xerox WorkCentre 65 1.02.028.3

Xerox WorkCentre Pro 35 1.02.353.1

Xerox WorkCentre Pro 55 1.02.353.1

Xerox WorkCentre Pro 65

Xerox Document Centre 545

Xerox WorkCentre M45 2.028.11.000

Xerox WorkCentre 75 1.001.02.076.1

Xerox WorkCentre M45 1.02.353.1

Xerox WorkCentre M55 2.028.11.000

Xerox WorkCentre 90 1.001.02.076.1

Xerox WorkCentre Pro 45

Xerox WorkCentre 75 1.001.00.060

Xerox WorkCentre 65 1.001.00.060

Xerox WorkCentre Pro 90 1.001.02.084

Xerox Document Centre 432

Xerox Document Centre 535

Xerox WorkCentre Pro 35 1.02.378.1

Xerox WorkCentre 40 Color 1.00.060

Xerox WorkCentre Pro 35 1.01.108.1

Xerox WorkCentre Pro 45 1.02.353.1

Xerox WorkCentre Pro 55 1.01.108.1

Xerox WorkCentre M45 1.01.108.1

Xerox WorkCentre M55 4.84.16.000

Xerox WorkCentre M45 1.02.378.1

Xerox WorkCentre Pro 45 1.01.108.1

Xerox WorkCentre Pro 55 3.97.20.032

Xerox WorkCentre 40 Color 01.02.053.1

Xerox Document Centre 430

Xerox WorkCentre Pro 35 3.97.20.032

Xerox WorkCentre M35 1.02.353.1

Xerox Document Centre 426

Xerox WorkCentre Pro 55 1.02.378.1

Xerox Document Centre 425

Xerox WorkCentre M35 4.84.16.000

Xerox WorkCentre M55 1.02.378.1

Xerox WorkCentre 32 Color 01.02.077.1

Xerox Document Centre 480

References

Xerox Document Centre ESS/Network Controller Web Server Remote Authentication Bypass Vulnerability

References:
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report