Xerox Printers Improper Neutralization of Special Elements used in an OS Command (CVE-2024-6333)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505562);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/27");

  script_cve_id("CVE-2024-6333");

  script_name(english:"Xerox Printers Improper Neutralization of Special Elements used in an OS Command (CVE-2024-6333)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Authenticated Remote Code Execution in Altalink, Versalink &
WorkCentre Products.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://securitydocs.business.xerox.com/wp-content/uploads/2024/10/Xerox%C2%AE-Security-Bulletin-XRX24-015-for-Altalink-Versalink-and-WorkCentre_CVE-2024-6333-.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b5167424");
  # https://web.archive.org/web/20241111073418/https://download.support.xerox.com/pub/docs/VLB415/userdocs/any-os/ar/VersaLink_Product-Enhancements-ReadMe_121.xxx.004.22720.pdf
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-6333");
  script_cwe_id(77);
  script_cwe_id(78);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/10/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/10/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/27");

  script_set_attribute(attribute:"plugin_type", value:"remote");

  # AltaLink series (103.xxx.CCC.DDDDD - mainline branches prior to patch 024.18600)
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8030_firmware:103.001.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8030_firmware:103.001.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8030_firmware:103.001.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8030_firmware:103.001.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8035_firmware:103.001.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8035_firmware:103.001.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8035_firmware:103.001.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8035_firmware:103.001.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8045_firmware:103.002.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8045_firmware:103.002.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8045_firmware:103.002.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8045_firmware:103.002.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8055_firmware:103.002.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8055_firmware:103.002.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8055_firmware:103.002.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8055_firmware:103.002.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8070_firmware:103.003.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8070_firmware:103.003.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8070_firmware:103.003.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8070_firmware:103.003.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8045_firmware:103.008.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8045_firmware:103.008.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8045_firmware:103.008.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8045_firmware:103.008.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8055_firmware:103.008.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8055_firmware:103.008.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8055_firmware:103.008.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8055_firmware:103.008.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8065_firmware:103.008.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8065_firmware:103.008.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8065_firmware:103.008.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8065_firmware:103.008.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8075_firmware:103.008.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8075_firmware:103.008.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8075_firmware:103.008.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8075_firmware:103.008.042");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8090_firmware:103.008.014");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8090_firmware:103.008.024");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8090_firmware:103.008.033");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8090_firmware:103.008.042");

  # AltaLink C8100/B8100 - Standard branch (121.xxx.004)
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8130_firmware:121.009.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8135_firmware:121.009.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8145_firmware:121.010.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8155_firmware:121.010.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_c8170_firmware:121.011.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8145_firmware:121.013.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8155_firmware:121.013.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:altalink_b8170_firmware:121.014.004");

  # VersaLink - Standard branch (121.xxx.004) recovered via web archive
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b415_firmware:121.029.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c415_firmware:121.028.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b620_firmware:121.027.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c620_firmware:121.026.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_b625_firmware:121.025.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:versalink_c625_firmware:121.024.004");

  # WorkCentre series (075.xxx.004)
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7830_firmware:075.010.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7835i_firmware:075.010.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_ec7856_firmware:075.020.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7220_firmware:075.030.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7225i_firmware:075.030.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7845_firmware:075.040.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7855i_firmware:075.040.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_ec7836_firmware:075.050.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_3655_firmware:075.060.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_3655i_firmware:075.060.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7855_firmware:075.080.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_5945_firmware:075.091.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_5955i_firmware:075.091.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_6655_firmware:075.110.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_6655i_firmware:075.110.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7970_firmware:075.200.004");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:xerox:workcentre_7970i_firmware:075.200.004");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Xerox");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Xerox');

var asset = tenable_ot::assets::get(vendor:'Xerox');

var vuln_cpes = {
    # C8000 series patched in the 103.xxx.024.18600 build:
    "cpe:/o:xerox:altalink_c8030_firmware" :
        {"versionEndExcluding" : "103.001.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8035_firmware" :
        {"versionEndExcluding" : "103.001.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8045_firmware" :
        {"versionEndExcluding" : "103.002.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8055_firmware" :
        {"versionEndExcluding" : "103.002.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8070_firmware" :
        {"versionEndExcluding" : "103.003.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8045_firmware" :
        {"versionEndExcluding" : "103.008.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8055_firmware" :
        {"versionEndExcluding" : "103.008.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8065_firmware" :
        {"versionEndExcluding" : "103.008.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8075_firmware" :
        {"versionEndExcluding" : "103.008.024.18600", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8090_firmware" :
        {"versionEndExcluding" : "103.008.024.18600", "family" : "AltaLink"},

    # C8100/B8100 series patched in the 121.xxx.004.22720 build.
    "cpe:/o:xerox:altalink_c8130_firmware" :
        {"versionEndExcluding" : "121.009.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8135_firmware" :
        {"versionEndExcluding" : "121.009.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8145_firmware" :
        {"versionEndExcluding" : "121.010.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8155_firmware" :
        {"versionEndExcluding" : "121.010.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_c8170_firmware" :
        {"versionEndExcluding" : "121.011.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8145_firmware" :
        {"versionEndExcluding" : "121.013.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8155_firmware" :
        {"versionEndExcluding" : "121.013.004.22720", "family" : "AltaLink"},
    "cpe:/o:xerox:altalink_b8170_firmware" :
        {"versionEndExcluding" : "121.014.004.22720", "family" : "AltaLink"},

    # VersaLink series patched in the 121.xxx.004.22720 build.
    "cpe:/o:xerox:versalink_b415_firmware" :
        {"versionEndExcluding" : "121.029.004.22720", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c415_firmware" :
        {"versionEndExcluding" : "121.028.004.22720", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b620_firmware" :
        {"versionEndExcluding" : "121.027.004.22720", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c620_firmware" :
        {"versionEndExcluding" : "121.026.004.22720", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_b625_firmware" :
        {"versionEndExcluding" : "121.025.004.22720", "family" : "VersaLink"},
    "cpe:/o:xerox:versalink_c625_firmware" :
        {"versionEndExcluding" : "121.024.004.22720", "family" : "VersaLink"},

    # WorkCentre series (075.xxx.004.07810)
    "cpe:/o:xerox:workcentre_7830_firmware:075.010.004" :
        {"versionEndExcluding" : "075.010.004.07810", "versionStartIncluding" : "075.010.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7835i_firmware:075.010.004" :
        {"versionEndExcluding" : "075.010.004.07810", "versionStartIncluding" : "075.010.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_ec7856_firmware:075.020.004" :
        {"versionEndExcluding" : "075.020.004.07810", "versionStartIncluding" : "075.020.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7220_firmware:075.030.004" :
        {"versionEndExcluding" : "075.030.004.07810", "versionStartIncluding" : "075.030.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7225i_firmware:075.030.004" :
        {"versionEndExcluding" : "075.030.004.07810", "versionStartIncluding" : "075.030.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7845_firmware:075.040.004" :
        {"versionEndExcluding" : "075.040.004.07810", "versionStartIncluding" : "075.040.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7855i_firmware:075.040.004" :
        {"versionEndExcluding" : "075.040.004.07810", "versionStartIncluding" : "075.040.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_ec7836_firmware:075.050.004" :
        {"versionEndExcluding" : "075.050.004.07810", "versionStartIncluding" : "075.050.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_3655_firmware:075.060.004" :
        {"versionEndExcluding" : "075.060.004.07810", "versionStartIncluding" : "075.060.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_3655i_firmware:075.060.004" :
        {"versionEndExcluding" : "075.060.004.07810", "versionStartIncluding" : "075.060.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7855_firmware:075.080.004" :
        {"versionEndExcluding" : "075.080.004.07810", "versionStartIncluding" : "075.080.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_5945_firmware:075.091.004" :
        {"versionEndExcluding" : "075.091.004.07810", "versionStartIncluding" : "075.091.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_5955i_firmware:075.091.004" :
        {"versionEndExcluding" : "075.091.004.07810", "versionStartIncluding" : "075.091.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_6655_firmware:075.110.004" :
        {"versionEndExcluding" : "075.110.004.07810", "versionStartIncluding" : "075.110.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_6655i_firmware:075.110.004" :
        {"versionEndExcluding" : "075.110.004.07810", "versionStartIncluding" : "075.110.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7970_firmware:075.200.004" :
        {"versionEndExcluding" : "075.200.004.07810", "versionStartIncluding" : "075.200.004.00000", "family" : "WorkCentre"},
    "cpe:/o:xerox:workcentre_7970i_firmware:075.200.004" :
        {"versionEndExcluding" : "075.200.004.07810", "versionStartIncluding" : "075.200.004.00000", "family" : "WorkCentre"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);