CVE-2024-12510: LDAP Authentication Sever Pass-back attack

Description

If LDAP settings are accessed, authentication could be redirected to another server, potentially exposing credentials. This requires admin access and an active LDAP setup.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

P6

Phaser 6510 · Xerox

before 64.75.53 · source: vendor

VB

Versalink B400 · Xerox

before 37.82.53 · source: vendor

VB

Versalink B405 · Xerox

before 38.82.53 · source: vendor

VB

Versalink B600/B610 · Xerox

before 32.82.53 · source: vendor

VB

Versalink B605/B615 · Xerox

before 33.82.53 · source: vendor

VB

Versalink B7025/B7030/B7035 · Xerox

before 58.75.53 · source: vendor

VB

Versalink B7125/B7130/B7135 · Xerox

before 59.24.53 · source: vendor

VC

Versalink C400 · Xerox

before 67.82.53 · source: vendor

VC

Versalink C405 · Xerox

before 68.82.53 · source: vendor

VC

Versalink C500/C600 · Xerox

before 61.82.53 · source: vendor

VC

Versalink C505/C605 · Xerox

before 62.82.53 · source: vendor

VC

Versalink C7000 · Xerox

before 56.75.53 · source: vendor