Xerox Printers Missing Authentication for Critical Function (CVE-2024-12511)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505551);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/29");

  script_cve_id("CVE-2024-12511");

  script_name(english:"Xerox Printers Missing Authentication for Critical Function (CVE-2024-12511)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials.
This requires enabled scan functions and printer access.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox%C2%AE-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre_CVE-2024-6333-.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b5167424");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-12511");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(306, 522);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/03");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b400_firmware:37.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b405_firmware:38.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c400_firmware:67.84");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c405_firmware:68.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b600_firmware:32.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b610_firmware:32.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b605_firmware:33.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b615_firmware:33.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c500_firmware:61.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c600_firmware:61.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c505_firmware:62.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c605_firmware:62.82");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7000_firmware:56.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7020_firmware:57.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7025_firmware:57.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7030_firmware:57.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7025_firmware:58.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7030_firmware:58.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7035_firmware:58.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7125_firmware:59.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7130_firmware:59.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b7135_firmware:59.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7120_firmware:69.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7125_firmware:69.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c7130_firmware:69.24");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c8000_firmware:70.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c9000_firmware:70.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c8000w_firmware:72.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:phaser_6510_firmware:64.75");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_6515_firmware:65.75");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Xerox");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Xerox');

var asset = tenable_ot::assets::get(vendor:'Xerox');

var vuln_cpes = {
    "cpe:/o:xerox:versalink_b400_firmware:37.82" :
        {"versionEndExcluding" : "37.82.71", "versionStartIncluding" : "37.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b405_firmware:38.82" :
        {"versionEndExcluding" : "38.82.71", "versionStartIncluding" : "38.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c400_firmware:67.84" :
        {"versionEndExcluding" : "67.84.71", "versionStartIncluding" : "67.84.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c405_firmware:68.82" :
        {"versionEndExcluding" : "68.82.71", "versionStartIncluding" : "68.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b600_firmware:32.82" :
        {"versionEndExcluding" : "32.82.71", "versionStartIncluding" : "32.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b610_firmware:32.82" :
        {"versionEndExcluding" : "32.82.71", "versionStartIncluding" : "32.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b605_firmware:33.82" :
        {"versionEndExcluding" : "33.82.71", "versionStartIncluding" : "33.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b615_firmware:33.82" :
        {"versionEndExcluding" : "33.82.71", "versionStartIncluding" : "33.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c500_firmware:61.82" :
        {"versionEndExcluding" : "61.82.71", "versionStartIncluding" : "61.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c600_firmware:61.82" :
        {"versionEndExcluding" : "61.82.71", "versionStartIncluding" : "61.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c505_firmware:62.82" :
        {"versionEndExcluding" : "62.82.71", "versionStartIncluding" : "62.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c605_firmware:62.82" :
        {"versionEndExcluding" : "62.82.71", "versionStartIncluding" : "62.82.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7000_firmware:56.75" :
        {"versionEndExcluding" : "56.75.71", "versionStartIncluding" : "56.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7020_firmware:57.75" :
        {"versionEndExcluding" : "57.75.71", "versionStartIncluding" : "57.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7025_firmware:57.75" :
        {"versionEndExcluding" : "57.75.71", "versionStartIncluding" : "57.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7030_firmware:57.75" :
        {"versionEndExcluding" : "57.75.71", "versionStartIncluding" : "57.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7025_firmware:58.75" :
        {"versionEndExcluding" : "58.75.71", "versionStartIncluding" : "58.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7030_firmware:58.75" :
        {"versionEndExcluding" : "58.75.71", "versionStartIncluding" : "58.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7035_firmware:58.75" :
        {"versionEndExcluding" : "58.75.71", "versionStartIncluding" : "58.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7125_firmware:59.24" :
        {"versionEndExcluding" : "59.24.71", "versionStartIncluding" : "59.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7130_firmware:59.24" :
        {"versionEndExcluding" : "59.24.71", "versionStartIncluding" : "59.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b7135_firmware:59.24" :
        {"versionEndExcluding" : "59.24.71", "versionStartIncluding" : "59.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7120_firmware:69.24" :
        {"versionEndExcluding" : "69.24.71", "versionStartIncluding" : "69.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7125_firmware:69.24" :
        {"versionEndExcluding" : "69.24.71", "versionStartIncluding" : "69.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c7130_firmware:69.24" :
        {"versionEndExcluding" : "69.24.71", "versionStartIncluding" : "69.24.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c8000_firmware:70.75" :
        {"versionEndExcluding" : "70.75.71", "versionStartIncluding" : "70.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c9000_firmware:70.75" :
        {"versionEndExcluding" : "70.75.71", "versionStartIncluding" : "70.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c8000w_firmware:72.75" :
        {"versionEndExcluding" : "72.75.71", "versionStartIncluding" : "72.75.00", "family" : "VersaLink"},
    "cpe:/o:xerox:phaser_6510_firmware:64.75" :
        {"versionEndExcluding" : "64.75.71", "versionStartIncluding" : "64.75.00", "family" : "Phaser"},
    "cpe:/o:xerox:workcentre_6515_firmware:65.75" :
        {"versionEndExcluding" : "65.75.71", "versionStartIncluding" : "65.75.00", "family" : "WorkCentre"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);