CVE-2020-9330

What it is

Certain Xerox WorkCentre printers before 073.xxx.000.02300 do not require the user to reenter or validate LDAP bind credentials when changing the LDAP connector IP address. A malicious actor who gains access to affected devices (e.g., by using default credentials) can change the LDAP connection IP address to a system owned by the actor without knowledge of the LDAP bind credentials. After changing the LDAP connection IP address, subsequent authentication attempts will result in the printer sending plaintext LDAP (Active Directory) credentials to the actor. Although the credentials may belong to a non-privileged user, organizations frequently use privileged service accounts to bind to Active Directory. The attacker gains a foothold on the Active Directory domain at a minimum, and may use the credentials to take over control of the Active Directory domain. This affects 3655*, 3655i*, 58XX*, 58XXi*, 59XX*, 59XXi*, 6655**, 6655i**, 72XX*, 72XXi*, 78XX**, 78XXi**, 7970**, 7970i**, EC7836**, and EC7856** devices.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

1.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2020-02-21 23:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-06-17 03:27 UTC Last updatedMost recent change to the record

Why it ranks here

• Exploited in the wild: no, CISA does not list it.
• Exploit odds: 1.1% in the next 30 days (EPSS).
• Severity: 8.8 HIGH (CVSS).
• Fix: a patch or advisory is linked.

Details

Published

2020-02-21 23:15 UTC

Last modified

2026-06-17 03:27 UTC

Exploit probability

1.1% · EPSS, next 30 days

Weakness

CWE-306 · Missing authentication

Record status

Modified

Affected

• Xerox Workcentre 3655 Firmware < 073.060.000.02300
• Xerox Workcentre 3655i Firmware < 073.060.000.02300
• Xerox Workcentre 5845 Firmware < 073.190.000.02300
• Xerox Workcentre 5855 Firmware < 073.190.000.02300
• Xerox Workcentre 5945 Firmware < 073.091.000.02300
• Xerox Workcentre 5955 Firmware < 073.091.000.02300
• Xerox Workcentre 6655 Firmware < 073.110.000.02300
• Xerox Workcentre 6655i Firmware < 073.110.000.02300

Attack profile CVSS 3.1 · 8.8

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Is it in your code?

Hand this to your coding agent. It searches your project for the affected products and checks versions. Nothing leaves your machine.

Read https://cve-list.com/agent/cve/CVE-2020-9330.md and follow it. Check whether this project is affected by CVE-2020-9330. Read only. Don't change anything and don't upload my code. Tell me yes, no or not sure, with the file as proof.

Copy as ticket · More options · Status badge