Vulnerability Description
Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks.
CVSS Score
7.5
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xerox | Phaser 3320 Firmware | v53.006.16.000 |
| Xerox | Phaser 3320 | - |
Related Weaknesses (CWE)
References
- https://security.business.xerox.com/Vendor Advisory
- https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabiThird Party Advisory
- https://security.business.xerox.com/Vendor Advisory
- https://www.nccgroup.trust/us/our-research/technical-advisory-multiple-vulnerabiThird Party Advisory
FAQ
What is CVE-2019-13166?
CVE-2019-13166 is a vulnerability with a CVSS score of 7.5 (HIGH). Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement account lockout. Local account credentials may be extracted from the device via brute force guessing attacks.
How severe is CVE-2019-13166?
CVE-2019-13166 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13166?
Check the references section above for vendor advisories and patch information. Affected products include: Xerox Phaser 3320 Firmware, Xerox Phaser 3320.