PT-2022-11645 · Printerlogic · Printerlogic Web Stack

Published 2022-02-02 · Updated 2022-02-08 · CVE-2021-42640

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrinterLogic Web Stack versions 19.1.1.13 SP9 and below

Description The issue is related to an Insecure Direct Object Reference (IDOR) vulnerability. This vulnerability allows an unauthenticated attacker to reassign drivers for any printer.

Recommendations For PrinterLogic Web Stack versions 19.1.1.13 SP9 and below, update to a version above 19.1.1.13 SP9 to resolve the issue. As a temporary workaround, consider restricting access to the printer driver reassignment functionality until a patch is available.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-42640

Affected Products

Printerlogic Web Stack

References · 10

• 🔥 https://yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert · Exploit
• https://osv.dev/vulnerability/CVE-2021-42640 · Vendor Advisory
• https://printerlogic.com/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42640 · Security Note
• https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpoints · Note
• http://printerlogic.com · Note
• https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suite · Note
• https://securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suite · Note
• https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.html · Note
• https://t.me/cibsecurity/36720 · Telegram Post