Xerox VersaLink C7025 Multifunction printer flaws may expose Windows Active Directory credentials to attackers

Rapid7 and SecurityAffairs disclosed two pass-back vulnerabilities in Xerox VersaLink C7025 multifunction printers (CVE-2024-12510 - LDAP, CVE-2024-12511 - SMB/FTP) that allow an attacker with access to the printer's admin/configuration to redirect authentication lookups to attacker-controlled hosts and capture clear-text or NetNTLMv2 credentials, risking Windows Active Directory compromise and lateral movement; affected firmware is 57.69.91 and earlier, and recommended mitigations are updating firmware, setting strong admin passwords, avoiding high-privilege service accounts for LDAP/SMB, and disabling unauthenticated remote access.