Attack Chain

1. Attacker establishes network connectivity to the target printer's administrative web interface.
2. Attacker authenticates to the web interface using valid administrative credentials (default or stolen).
3. Attacker navigates to the /properties/security/network_troubleshooting_log.php configuration page.
4. Attacker stops any active or existing network troubleshooting log sessions to prepare the configuration.
5. Attacker inputs a malicious shell command payload into the security.nwtroubleshoot.destination.server field.
6. Attacker initiates the network log capture via the web interface.
7. The device processes the configuration, executing the injected shell command as a system-level process.
8. Attacker receives a reverse shell connection or achieves the intended impact on the target printer.

Impact

Successful exploitation allows an attacker with administrative access to execute arbitrary commands with the privileges of the device's web service user. This can lead to full device compromise, potential lateral movement into the local network from the printer, and the ability to intercept or manipulate print jobs, credentials, or network configuration settings.

Recommendation

Prioritize the following actions to mitigate risk associated with CVE-2024-6333:

• Update Xerox WorkCentre firmware to the latest manufacturer-provided versions that address CVE-2024-6333.
• Restrict access to the administrative web interface of all Xerox printers to trusted management IP addresses only.
• Disable default administrative passwords on all printer devices and enforce strong, unique credential management.
• Disable the Network Troubleshooting Log feature if it is not required for day-to-day operations.
• Monitor network traffic originating from printer IP addresses for unexpected reverse shell connections or abnormal outbound traffic to unknown destinations.