PT-2022-12214 · Lexmark · Lexmark Devices

David Berard + 5 · Published 2022-01-20 · Updated 2023-07-24 · CVE-2021-44736

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Lexmark devices (affected versions not specified)

Description The initial admin account setup wizard on Lexmark devices allows unauthenticated access to the "out of service erase" feature. This issue may be related to an unprotected API, potentially leading to remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-44736

ZDI-22-331

Affected Products

Lexmark Devices

References · 5

• https://support.lexmark.com/alerts · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-331 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-44736 · Security Note
• https://t.me/cybersecuritytechnologies/8723 · Telegram Post
• https://t.me/cibsecurity/35939 · Telegram Post