CVE-2024-12510

LDAP Authentication Sever Pass-back attack

State: Published
Severity: 6.7 Medium
Published: Feb 3, 2025
Updated: Feb 27, 2025
Reserved: Dec 11, 2024

Description

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.

Scores

CVSS	Score	Vector	Source
3.1	6.7 Medium	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L	Xerox

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
Versalink B400Xerox	before 37.82.53Affected
Versalink B405Xerox	before 38.82.53Affected
Versalink C400Xerox	before 67.82.53Affected
Versalink C405Xerox	before 68.82.53Affected
Versalink B600/B610Xerox	before 32.82.53Affected
Versalink B605/B615Xerox	before 33.82.53Affected
Versalink C500/C600Xerox	before 61.82.53Affected
Versalink C505/C605Xerox	before 62.82.53Affected
Versalink C7000Xerox	before 56.75.53Affected
Versalink C7020/C7025/C7030Xerox	before 57.75.53Affected
Versalink B7025/B7030/B7035Xerox	before 58.75.53Affected
Versalink B7125/B7130/B7135Xerox	before 59.24.53Affected
Versalink C7120/C7125/C7130Xerox	before 69.24.53Affected
Versalink C8000/C9000Xerox	before 70.75.53Affected
Versalink C8000WXerox	before 72.75.53Affected
Phaser 6510Xerox	before 64.75.53Affected
WorkCentre 6515Xerox	before 65.75.53Affected

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.