CVSS: 9.8EPSS: 24%CPEs: 160EXPL: 0CVE-2023-26068 – Lexmark Device Embedded Web Server Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-26068
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). An unauthenticated remote code execution vulnerability exists in the embedded webserver in certain Lexmark devices through 2023-02-19. The vulnerability is only exposed if, when setting up the printer or device, the user selects "Set up Later" when asked if they would like to add an Admin user. If no Admin user is created, the endpoint /cgi-bin/fax_change_faxtrace_settings is accessible without authentication. The endpoint allows the user to configure a number of different fax settings. • http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 160EXPL: 0CVE-2023-26069 – Lexmark MC3224i snmpUTIL Improper Input Validation Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26069
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4). This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpUTIL binary. The issue results from the lack of proper validation of configuration files. An attacker can leverage this vulnerability to execute code in the context of the admin user. • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26069.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 265EXPL: 0CVE-2023-26070
https://notcve.org/view.php?id=CVE-2023-26070
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4). • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 256EXPL: 0CVE-2023-23560
https://notcve.org/view.php?id=CVE-2023-23560
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. En ciertos productos Lexmark hasta el 12 de enero de 2023, puede ocurrir SSRF debido a la falta de validación de entrada. • https://publications.lexmark.com/publications/security-alerts/CVE-2023-23560.pdf https://support.lexmark.com/alerts • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 256EXPL: 1CVE-2023-22960
https://notcve.org/view.php?id=CVE-2023-22960
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. Los productos Lexmark hasta el 10 de enero de 2023 tienen un control inadecuado de la frecuencia de interacción. • https://github.com/t3l3machus/CVE-2023-22960 https://publications.lexmark.com/publications/security-alerts/CVE-2023-22960.pdf • CWE-307: Improper Restriction of Excessive Authentication Attempts •