Lantronix xPrintServer Cross-Site Request Forgery and Arbitrary Command Execution Vulnerabilities

Bugtraq ID:	71341
Class:	Input Validation Error
CVE:	CVE-2014-9003 CVE-2014-9002
Remote:	Yes
Local:	No
Published:	Nov 11 2014 12:00AM
Updated:	Jul 06 2016 02:42PM
Credit:	Jim Bauwens
Vulnerable:
Not Vulnerable:

Lantronix xPrintServer Cross-Site Request Forgery and Arbitrary Command Execution Vulnerabilities

Lantronix xPrintServer is prone to a cross-site request-forgery vulnerability and an arbitrary command-execution vulnerability.

An attacker may exploit this issue to execute arbitrary commands and perform certain administrative actions and gain unauthorized access to the affected device. Other attacks are also possible.

Lantronix xPrintServer Cross-Site Request Forgery and Arbitrary Command Execution Vulnerabilities

An attacker can exploit this issue using readily available commands and tools.

Lantronix xPrintServer Cross-Site Request Forgery and Arbitrary Command Execution Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Lantronix xPrintServer Cross-Site Request Forgery and Arbitrary Command Execution Vulnerabilities

References:

• xPrintServer Homepage (Lantronix)
  
• Lantronix xPrintServer Code execution and CSRF vulnerability (Jim Bauwens)
  
• VU#785823 Lantronix xPrintServer contains multiple vulnerabilities (KB CERT)