News on Xerox Product Security

Xerox Product Security: The Heartbleed OpenSSL Vulnerability V1.10 (PDF 551.8K)

A vulnerability has been discovered in the OpenSSL cryptographic software version 1.0.1 to 1.0.1f widely used across the Internet for banking, investment, medical and other encrypted network traffic.

This document lists the Xerox products and whether or not they are affected by this issue. There are also explanations of Recommend Actions.

Detailed descriptions of the issues may be found at the US-CERT web site:
http://www.kb.cert.org/vuls/id/720951

Xerox Product Security: The Man In The Middle (MITM) OpenSSL Vulnerability V1.1 (PDF 860.5K)

NOTE: A new document indicates software updates for Xerox devices previously vulnerable. This version of the document is for hardware only. Software products and web sites are still being investigated.

A vulnerability was reported in OpenSSL versions 0.9.8 – 0.9.8z and 1.0.1-1.0.1g that allow a Man-In-The-Middle attack. The attack would require that both hosts have a vulnerable version of OpenSSL.

This problem affects very few cases as shown below.

  • Microsoft Windows (all versions, client or servers) are not affected as those Operating Systems uses a different encryption tool.
  • Apple Macintosh users (all versions, clients or servers) are not affected as that Operating System uses a different encryption tool.
  • Linux clients or server versions are able to upgrade to a non-vulnerable OpenSSL easily using the APT or RPM Package Management tools.
  • Solaris client or server versions are able to upgrade to a non-vulnerable OpenSSL easily using the dpkg Package Management tool

Beyond showing that many Operating Systems are not vulnerable or can be easily protected, it is very unlikely that an attacker could predict and be ready to act at the precise moment when two vulnerable devices are communicating. This document lists Xerox products and whether they are affected by this issue.

Xerox Product Security: The Heartbleed OpenSSL Vulnerability V1.9 (PDF 1.3M)

A vulnerability has been discovered in the OpenSSL cryptographic software version 1.0.1 to 1.0.1f widely used across the Internet for banking, investment, medical and other encrypted network traffic.

This document lists the Xerox products and whether or not they are affected by this issue. There are also explanations of Recommend Actions.

Detailed descriptions of the issues may be found at the US-CERT web site:
http://www.kb.cert.org/vuls/id/720951

Consult the Chief Optimist

Read about seeing and seizing opportunities others may miss. Review and explore, and even interact. See optimistic info and ideas in the on-line Chief Optimist e-zine.

Thousands of office printers hit by “gibberish” malware

The Trojan.Milicenso malware is sending data to printers and multi-function devices which results in output of multiple pages of unintelligible characters which may cause the device to run out of paper. This malware can infect a workstation, laptop, or desktop computer if the user opens an e-mail attachment, visits a web site with the malware delivered there or downloads a file that appears to be audio or video codecs (encoders/decoders). The malware does not infect the Xerox print device. No actions or changes are needed for the Xerox print device.


Xerox recommends that users follow industry best practices and vendor recommendations to protect computer operating systems from malware and respond to infections.


Depending on the printer or multi-function device, if this malware prints using a specific paper tray, it may be possible to empty or disable that tray to stop paper waste.

Xerox Security Message: Reminder to Set Firmware Password on Networked Printers

We continue to see news articles concerning potential vulnerabilities around certain networked products. At Xerox, a great deal of our focus goes to ensuring the safety and security of our customers’ equipment.
For years we’ve been communicating publicly the threat to embedded devices or networked peripherals. Anything connected to your network – whether a fax machine, copier, printer, scanner, or PC – is vulnerable to outside attacks. It’s a topic we discuss often on this security website, and we continue to share with our customers the importance of securing safely all of their devices.
Recent media coverage of Columbia University researchers infiltrating a competitive printer via firmware has brought this subject to light. The infiltration they conducted is certainly not easy to do, but customers need to be aware of and prepared for this vulnerability.
Specific to Xerox:

  • A firmware update function exists on Xerox Phasers and one ColorQube®(ColorQube 8570). The firmware update function can be password protected on all Xerox Phasers, enabling customers to have a first line of defense against a potential attack. Customers can access their password settings by accessing the printer’s CentreWare Internet Services security settings page reachable at https:// device_ip_address /securitysettings.html
  • Other equipment (WorkCentre® line, ColorQubes except the CQ 8570, FreeFlow® Print Server, DocuColor® models, etc.) use an entirely different upgrade mechanism and are not vulnerable to the same type of exploit.


We’re continually testing to identify new security threats to our technology. We encourage you to continue to check this site for the most recent Xerox security updates. If you have questions on how to best lock down your Xerox device, please contact your sales rep, submit a request online here, or in the U.S. call us at 1-800-821-2797.

Common Criteria Certification of the ColorQube 9201/9202/9203

In Evaluation
NIAP evaluation listing

Common Criteria Certification of the WorkCentre 7755/7765/7775

In Evaluation
NIAP evaluation listing