Authenticated Remote Code Execution in Xerox WorkCentre Printers (CVE-2024-6333)

CVE-2024-6333 is a high-severity vulnerability affecting Xerox WorkCentre printers, including the WorkCentre 6655. The vulnerability resides in the Network Troubleshooting Log feature, accessible via /properties/security/network_troubleshooting_log.php. Attackers possessing valid administrative credentials can exploit an improper input sanitization flaw in the security.nwtroubleshoot.destination.server parameter. By injecting shell metacharacters into this field, an attacker can achieve arbitrary remote code execution on the underlying operating system when the device initiates the network log capture process. This vulnerability is critical for organizations that utilize default administrative credentials or fail to restrict access to the printer's administrative web interface. Proof-of-concept exploit code is publicly available, increasing the risk of exploitation.

Attack Chain

1. Attacker establishes network connectivity to the target printer's administrative web interface.
2. Attacker authenticates to the web interface using valid administrative credentials (default or stolen).
3. Attacker navigates to the /properties/security/network_troubleshooting_log.php configuration page.
4. Attacker stops any active or existing network troubleshooting log sessions to prepare the configuration.
5. Attacker inputs a malicious shell command payload into the security.nwtroubleshoot.destination.server field.
6. Attacker initiates the network log capture via the web interface.
7. The device processes the configuration, executing the injected shell command as a system-level process.
8. Attacker receives a reverse shell connection or achieves the intended impact on the target printer.

Impact

Successful exploitation allows an attacker with administrative access to execute arbitrary commands with the privileges of the device's web service user. This can lead to full device compromise, potential lateral movement into the local network from the printer, and the ability to intercept or manipulate print jobs, credentials, or network configuration settings.

Recommendation

Prioritize the following actions to mitigate risk associated with CVE-2024-6333:

• Update Xerox WorkCentre firmware to the latest manufacturer-provided versions that address CVE-2024-6333.
• Restrict access to the administrative web interface of all Xerox printers to trusted management IP addresses only.
• Disable default administrative passwords on all printer devices and enforce strong, unique credential management.
• Disable the Network Troubleshooting Log feature if it is not required for day-to-day operations.
• Monitor network traffic originating from printer IP addresses for unexpected reverse shell connections or abnormal outbound traffic to unknown destinations.