Xerox Printers Improper Authentication (CVE-2023-46327)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505559);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2023-46327");

  script_name(english:"Xerox Printers Improper Authentication (CVE-2023-46327)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Multiple MFPs (multifunction printers) provided by FUJIFILM Business
Innovation Corp. and Xerox Corporation provide a facility to export
the contents of their Address Book with encrypted form, but the
encryption strength is insufficient. With the knowledge of the
encryption process and the encryption key, the information such as the
server credentials may be obtained from the exported Address Book
data. As for the details of affected product names, model numbers, and
versions, refer to the information provided by the respective vendors
listed under [References].

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://jvn.jp/en/vu/JVNVU96482726/index.html");
  script_set_attribute(attribute:"see_also", value:"https://security.business.xerox.com/en-us/documents/bulletins/");
  # https://www.fujifilm.com/fbglobal/eng/company/news/notice/2023/1031_addressbook_announce.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e6effb10");
  # https://securitydocs.business.xerox.com/wp-content/uploads/2023/11/XRX23-015_Security-Bulletin-for-Primelink-Versalink-and-WorkCentre-CVE-023-46327-1.pdf");
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?5964be67");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-46327");
  script_cwe_id(287);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/11/01");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/10/31");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b405_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b605_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b615_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7125_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7130_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7135_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c405_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c505_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c605_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7000_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7020_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7025_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7030_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7120_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7125_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7130_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_6515_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Xerox");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Xerox');

var asset = tenable_ot::assets::get(vendor:'Xerox');

var vuln_cpes = {
    "cpe:/o:xerox:versalink_c405_firmware" :
        {"versionEndExcluding" : "68.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c505_firmware" :
        {"versionEndExcluding" : "62.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c605_firmware" :
        {"versionEndExcluding" : "62.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7000_firmware" :
        {"versionEndExcluding" : "56.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7020_firmware" :
        {"versionEndExcluding" : "57.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7025_firmware" :
        {"versionEndExcluding" : "57.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7030_firmware" :
        {"versionEndExcluding" : "57.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7130_firmware" :
        {"versionEndExcluding" : "69.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7125_firmware" :
        {"versionEndExcluding" : "69.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7120_firmware" :
        {"versionEndExcluding" : "69.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b405_firmware" :
        {"versionEndExcluding" : "38.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b605_firmware" :
        {"versionEndExcluding" : "33.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b615_firmware" :
        {"versionEndExcluding" : "33.81.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7125_firmware" :
        {"versionEndExcluding" : "59.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7130_firmware" :
        {"versionEndExcluding" : "59.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7135_firmware" :
        {"versionEndExcluding" : "59.23.41", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7025_firmware" :
        {"versionEndExcluding" : "58.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7030_firmware" :
        {"versionEndExcluding" : "58.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7035_firmware" :
        {"versionEndExcluding" : "58.74.51", "family" : "VersaLink"},
    "cpe:/o:xerox:workcentre_6515_firmware" :
        {"versionEndExcluding" : "65.74.51", "family" : "WorkCentre"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);