Lexmark warns of RCE bug affecting 100 printer models, PoC released

guest · Jan 26, 2023

By Bill Toulas @billtoulas - January 26, 2023

Lexmark has released a security firmware update to fix a severe vulnerability that could enable remote code execution (RCE) on more than 100 printer models.
Click to expand...

The security issue is tracked as CVE-2023-23560 and, according to the company, it has a severity rating of 9.0. It is a server-side request forgery (SSRF) in the Web Services feature of Lexmark devices.
No evidence of exploitation
The vendor’s advisory says that the bug could be leveraged to gain arbitrary code execution on the device, which could have a wider impact in an organization.

Lexmark says that the vulnerability is not under active exploitation at this time. However, proof of concept (PoC) exploit code has been published, which users should view as a strong recommendation to apply the vendor's patch.

“Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory, but proof of concept code has been publicly published” - Lexmark
Click to expand...

The security advisory lists more than 100 printer models as being impacted if they run a vulnerable firmware release. Users are advised to check the firmware level and make sure that it matches an update that addresses the issue.

CVE-2023-23560 impacts a large number of Lexmark printers, so owners of Lexmark devices are recommended to check the advisory and confirm they’re running a safe firmware version released on or after January 18, 2022.
Click to expand...

Lexmark Security Advisory
(PDF): https://publications.lexmark.com/publications/security-alerts/CVE-2023-23560.pdf

Log in or Sign up

Lexmark warns of RCE bug affecting 100 printer models, PoC released

guest Guest

Log in or Sign up

Lexmark warns of RCE bug affecting 100 printer models, PoC released

guest Guest

Useful Searches