CVE-2024-12511 HIGH

CVE-2024-12511: SMB/FTP Address Book Scan Pass-back attack

Vendor Xerox
Product Versalink B400
Weakness CWE-306 · Missing auth
Published February 3, 2025
Last update September 17, 2025
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

With address book access, SMB/FTP settings could be modified, redirecting scans and possibly capturing credentials. This requires enabled scan functions and printer access.

Key dates

02Disclosure timeline

February 3, 2025 CVE published
September 17, 2025 Record updated