PT-2016-1247 · Lexmark · Lexmark Printers

Published 2016-01-27 · Updated 2016-02-01 · CVE-2016-1896

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lexmark printers with firmware ATL before ATL.02.049 Lexmark printers with firmware CB before CB.02.049 Lexmark printers with firmware PP before PP.02.049 Lexmark printers with firmware YK before YK.02.049

Description The issue is related to a race condition in the initialization process of Lexmark printers, which can be exploited by remote attackers to bypass authentication. This is due to incorrect detection of the security-jumper status, allowing an attacker to leverage insufficient checking of a shared resource's state.

Recommendations For Lexmark printers with firmware ATL before ATL.02.049, update the firmware to ATL.02.049 or later. For Lexmark printers with firmware CB before CB.02.049, update the firmware to CB.02.049 or later. For Lexmark printers with firmware PP before PP.02.049, update the firmware to PP.02.049 or later. For Lexmark printers with firmware YK before YK.02.049, update the firmware to YK.02.049 or later.

Fix

Weakness Enumeration

CWE-254

CWE-264

Related Identifiers

BDU:2016-00508

CVE-2016-1896

Affected Products

Lexmark Printers

References · 5

• https://bdu.fstec.ru/vul/2016-00508 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-1896 · Security Note
• http://support.lexmark.com/index?page=content&id=TE745 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-1896 · Vendor Advisory
• http://support.lexmark.com/index?page=content&id=TE745 · Note