CVSS: 8.8EPSS: 0%CPEs: 472EXPL: 0CVE-2021-44737 – Lexmark MC3224i PJL Exposed Dangerous Function Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44737
PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. Una vulnerabilidad de salto de directorios PJL en dispositivos Lexmark versiones hasta 07-12-2021 que puede ser aprovechada para sobrescribir archivos de configuración internos This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of PJL commands. The issue results from an exposed danagerous function, which can allow the creation of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of root. • https://support.lexmark.com/alerts https://www.zerodayinitiative.com/advisories/ZDI-22-333 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 6%CPEs: 472EXPL: 0CVE-2021-44738 – Lexmark MC3224i PostScript Out-Of-Bounds Write Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2021-44738
Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter. Se ha identificado una vulnerabilidad de desbordamiento del búfer en los dispositivos Lexmark versiones hasta 07-12-2021, en el intérprete de postscript This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of PostScript data. Crafted PostScript data can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. • https://support.lexmark.com/alerts https://www.zerodayinitiative.com/advisories/ZDI-22-327 https://www.zerodayinitiative.com/advisories/ZDI-22-328 https://www.zerodayinitiative.com/advisories/ZDI-22-382 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 1CVE-2021-35449 – Lexmark Driver Privilege Escalation
https://notcve.org/view.php?id=CVE-2021-35449
The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM. El Lexmark Universal Print Driver versión 2.15.1.0 e inferior, driver versión G2 2.7.1.0 e inferior, G3 driver versión 3.2.0.0 e inferior y G4 driver versión 4.2.1.0 e inferior están afectados por una vulnerabilidad de escalada de privilegios. Un usuario estándar poco privilegiado puede usar el controlador para ejecutar una DLL de su elección durante el proceso de adición de la impresora, resultando en una escalada de privilegios a SYSTEM • http://packetstormsecurity.com/files/163811/Lexmark-Driver-Privilege-Escalation.html http://support.lexmark.com/alerts https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_02.txt • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-35469
https://notcve.org/view.php?id=CVE-2021-35469
The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquoted service path. Los paquetes de Instalación del Software de impresoras Lexmark G2, G3 y G4, presentan una vulnerabilidad de escalada local de privilegios debido a una entrada del registro que presenta una ruta de servicio no citada • http://support.lexmark.com/alerts http://support.lexmark.com/index?id=TE952&page=content&locale=en&userlocale=EN_US • CWE-428: Unquoted Search Path or Element •
CVSS: 5.4EPSS: 0%CPEs: 160EXPL: 0CVE-2020-10093
https://notcve.org/view.php?id=CVE-2020-10093
A cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products. Una vulnerabilidad de tipo cross-site scripting (XSS) en la impresora inkjet de la serie Lexmark Pro910 y otros productos discontinuados. • http://support.lexmark.com/index?page=content&id=TE936 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •