PT-2023-8589 · Lexmark · Lexmark Cx331Adwe

Sina Kheirkhah · Published 2023-11-09 · Updated 2024-02-29 · CVE-2023-50737

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lexmark CX331adwe (affected versions not specified)

Description A vulnerability in one of the SE menu routines of Lexmark printers can be leveraged by an attacker to execute arbitrary code. The issue exists due to a lack of authentication before providing access to certain functions. This allows a remote attacker to exploit the vulnerability and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-20

CWE-306

CWE-287

Related Identifiers

BDU:2024-01239

CVE-2023-50737

ZDI-24-084

Affected Products

Lexmark Cx331Adwe

References · 10

• https://bdu.fstec.ru/vul/2024-01239 · Security Note
• https://lexmark.com/en_us/solutions/security/lexmark-security-advisories.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50737 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-084 · Security Note
• https://twitter.com/VulmonFeeds/status/1762728174197068208 · Twitter Post
• https://t.me/cvenotify/72525 · Telegram Post
• http://zerodayinitiative.com/advisories/ZDI-24-084 · Note
• https://twitter.com/cracbot/status/1763269783611396582 · Twitter Post
• https://twitter.com/CVEnew/status/1762672066183192654 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1752814867340276048 · Twitter Post