CVSS: 9.8EPSS: 28%CPEs: 160EXPL: 0CVE-2023-26068 – Lexmark Device Embedded Web Server Remote Code Execution
https://notcve.org/view.php?id=CVE-2023-26068
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). An unauthenticated remote code execution vulnerability exists in the embedded webserver in certain Lexmark devices through 2023-02-19. The vulnerability is only exposed if, when setting up the printer or device, the user selects "Set up Later" when asked if they would like to add an Admin user. If no Admin user is created, the endpoint /cgi-bin/fax_change_faxtrace_settings is accessible without authentication. The endpoint allows the user to configure a number of different fax settings. • http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 160EXPL: 0CVE-2023-26069 – Lexmark MC3224i snmpUTIL Improper Input Validation Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2023-26069
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4). This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the snmpUTIL binary. The issue results from the lack of proper validation of configuration files. An attacker can leverage this vulnerability to execute code in the context of the admin user. • https://publications.lexmark.com/publications/security-alerts/CVE-2023-26069.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •
CVSS: 8.1EPSS: 18%CPEs: 166EXPL: 1CVE-2023-26067 – Lexmark MC3224i lbtraceapp Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2023-26067
Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). This vulnerability allows local attackers to escalate privileges on affected installations of Lexmark MC3224i printers. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the lbtraceapp binary. The code loads a binary from an unsecured location. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. • https://github.com/horizon3ai/CVE-2023-26067 http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html https://publications.lexmark.com/publications/security-alerts/CVE-2023-26067.pdf https://support.lexmark.com/alerts • CWE-20: Improper Input Validation •