{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/xerox/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:h:xerox:workcentre_6655:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2024-6333"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WorkCentre 6655"],"_cs_severities":["high"],"_cs_tags":["xerox","rce","cve","network"],"_cs_type":"advisory","_cs_vendors":["Xerox"],"content_html":"\u003cp\u003eCVE-2024-6333 is a high-severity vulnerability affecting Xerox WorkCentre printers, including the WorkCentre 6655. The vulnerability resides in the Network Troubleshooting Log feature, accessible via \u003ccode\u003e/properties/security/network_troubleshooting_log.php\u003c/code\u003e. Attackers possessing valid administrative credentials can exploit an improper input sanitization flaw in the \u003ccode\u003esecurity.nwtroubleshoot.destination.server\u003c/code\u003e parameter. By injecting shell metacharacters into this field, an attacker can achieve arbitrary remote code execution on the underlying operating system when the device initiates the network log capture process. This vulnerability is critical for organizations that utilize default administrative credentials or fail to restrict access to the printer's administrative web interface. Proof-of-concept exploit code is publicly available, increasing the risk of exploitation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker establishes network connectivity to the target printer's administrative web interface.\u003c/li\u003e\n\u003cli\u003eAttacker authenticates to the web interface using valid administrative credentials (default or stolen).\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the \u003ccode\u003e/properties/security/network_troubleshooting_log.php\u003c/code\u003e configuration page.\u003c/li\u003e\n\u003cli\u003eAttacker stops any active or existing network troubleshooting log sessions to prepare the configuration.\u003c/li\u003e\n\u003cli\u003eAttacker inputs a malicious shell command payload into the \u003ccode\u003esecurity.nwtroubleshoot.destination.server\u003c/code\u003e field.\u003c/li\u003e\n\u003cli\u003eAttacker initiates the network log capture via the web interface.\u003c/li\u003e\n\u003cli\u003eThe device processes the configuration, executing the injected shell command as a system-level process.\u003c/li\u003e\n\u003cli\u003eAttacker receives a reverse shell connection or achieves the intended impact on the target printer.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker with administrative access to execute arbitrary commands with the privileges of the device's web service user. This can lead to full device compromise, potential lateral movement into the local network from the printer, and the ability to intercept or manipulate print jobs, credentials, or network configuration settings.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize the following actions to mitigate risk associated with CVE-2024-6333:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate Xerox WorkCentre firmware to the latest manufacturer-provided versions that address CVE-2024-6333.\u003c/li\u003e\n\u003cli\u003eRestrict access to the administrative web interface of all Xerox printers to trusted management IP addresses only.\u003c/li\u003e\n\u003cli\u003eDisable default administrative passwords on all printer devices and enforce strong, unique credential management.\u003c/li\u003e\n\u003cli\u003eDisable the Network Troubleshooting Log feature if it is not required for day-to-day operations.\u003c/li\u003e\n\u003cli\u003eMonitor network traffic originating from printer IP addresses for unexpected reverse shell connections or abnormal outbound traffic to unknown destinations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T19:22:38Z","date_published":"2026-10-19T19:22:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-6333/","summary":"CVE-2024-6333 enables authenticated remote code execution on Xerox WorkCentre printers by injecting malicious shell commands into the network troubleshooting log configuration.","title":"Authenticated Remote Code Execution in Xerox WorkCentre Printers (CVE-2024-6333)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2024-6333/"}],"language":"en","title":"CraftedSignal Threat Feed - Xerox","version":"https://jsonfeed.org/version/1.1"}