CVE-2024-12511

SMB/FTP Address Book Scan Pass-back attack

State: Published
Severity: 7.6 High
Published: Feb 3, 2025
Updated: Sep 17, 2025
Reserved: Dec 11, 2024

Description

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.

Scores

CVSS	Score	Vector	Source
3.1	7.6 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L	Xerox

Weaknesses

CWE-306 Missing Authentication for Critical Function
CWE-522 Insufficiently Protected Credentials

Affected Products

Product	Versions
Versalink B400Xerox	before 37.82.53Affected
Versalink B405Xerox	before 38.82.53Affected
Versalink C400Xerox	before 67.82.53Affected
Versalink C405Xerox	before 68.82.53Affected
Versalink B600/B610Xerox	before 32.82.53Affected
Versalink B605/B615Xerox	before 33.82.53Affected
Versalink C500/C600Xerox	before 61.82.53Affected
Versalink C505/C605Xerox	before 62.82.53Affected
Versalink C7000Xerox	before 56.75.53Affected
Versalink C7020/C7025/C7030Xerox	before 57.75.53Affected
Versalink B7025/B7030/B7035Xerox	before 58.75.53Affected
Versalink B7125/B7130/B7135Xerox	before 59.24.53Affected
Versalink C7120/C7125/C7130Xerox	before 69.24.53Affected
Versalink C8000/C9000Xerox	before 70.75.53Affected
Versalink C8000WXerox	before 72.75.53Affected
Phaser 6510Xerox	before 64.75.53Affected
WorkCentre 6515Xerox	before 65.75.53Affected

References

https://securitydocs.business.xerox.com/wp-content/uploads/2025/02/Xerox-Security-Bulletin-XRX25-003-for-Xerox%C2%AE-for-VersaLinkPhaser-and-WorkCentre.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.