CVE-2023-26067 – Lexmark MC3224i lbtraceapp Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

https://notcve.org/view.php?id=CVE-2023-26067

Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). This vulnerability allows local attackers to escalate privileges on affected installations of Lexmark MC3224i printers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the lbtraceapp binary. The code loads a binary from an unsecured location. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. • https://github.com/horizon3ai/CVE-2023-26067 http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html https://publications.lexmark.com/publications/security-alerts/CVE-2023-26067.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •