CVE-2022-23968
📋 TL;DR
This vulnerability allows remote attackers to cause permanent denial of service on Xerox VersaLink devices by sending a crafted TIFF file via unauthenticated HTTP POST requests. The attack puts affected printers into an unrecoverable boot loop, requiring physical intervention by a technician to restore functionality. Organizations using vulnerable Xerox VersaLink printer firmware versions are affected.
💻 Affected Systems
- Xerox VersaLink printers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers can remotely brick all vulnerable printers in an organization, causing complete printing service disruption until field technicians physically service each device.
Likely Case
Targeted attacks against specific organizations or opportunistic attacks against internet-exposed printers causing service disruption.
If Mitigated
Minimal impact with proper network segmentation and updated firmware.
🎯 Exploit Status
Exploit requires crafting a TIFF file with an incomplete Image Directory and sending via HTTP POST. Public details and proof-of-concept exist in security articles.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after 2022-01-26
Vendor Advisory: Not explicitly provided in references, but vendor acknowledged issue on 2022-01-26
Restart Required: Yes
Instructions:
1. Check current firmware version on Xerox VersaLink devices. 2. Download latest firmware from Xerox support portal. 3. Upload and install firmware update via printer web interface. 4. Reboot printer after installation.
🔧 Temporary Workarounds
Network segmentation
allIsolate printers on separate VLANs with strict firewall rules blocking external access to printer management interfaces.
Disable external HTTP access
allConfigure firewall to block inbound HTTP/HTTPS traffic to printer management interfaces from untrusted networks.
🧯 If You Can't Patch
- Implement strict network access controls to limit HTTP POST requests to printer interfaces only from authorized management systems.
- Monitor printer reboot logs and network traffic for unusual HTTP POST requests containing TIFF files.
🔍 How to Verify
Check if Vulnerable:
Check firmware version via printer web interface (Settings > Device > About) and compare against vulnerable versions xx.42.01 and xx.50.61.Check Version:
Not applicable - check via printer web interface or physical display panelVerify Fix Applied:
Verify firmware version is newer than 2022-01-26 release and test HTTP POST functionality to confirm normal operation.📡 Detection & Monitoring
Log Indicators:
- Repeated printer reboots
- HTTP POST requests to printer with TIFF file uploads
- Failed image parsing errors in printer logs
Network Indicators:
- HTTP POST requests to printer management ports (typically 80/443) with TIFF file content
- Unusual source IPs accessing printer interfaces
SIEM Query:
source="printer_logs" AND (event="reboot" OR event="crash") OR destination_port IN (80, 443) AND http_method="POST" AND content_type="image/tiff"🔗 References
- https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/
- https://twitter.com/mqudsi/status/1485756915187695618
- https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/
- https://twitter.com/mqudsi/status/1485756915187695618
