CVE-2021-44734

Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device

published January 20, 2022

CVSS
—
EPSS
6%
Percentile
93.5
In the wild
Unconfirmed
What it is

⚠️ A sneaky input sanitization flaw in Lexmark devices could leave your printer as an open door for remote code execution! 🔥 Think of it like a coffee shop that doesn’t check orders thoroughly; a barista might mistakenly serve a drink with an extra shot of chaos instead of espresso. If someone slips a malicious command through the system, it could brew a whole pot of trouble. An attacker with knowledge of this vulnerability could gain control over the device, leading to unauthorized actions such as running malicious code or altering printer settings. This could result in data leaks or even leverage the device for larger network attacks, making it a surprisingly sneaky risk if left unchecked.

Put simply

Think of it like a coffee shop that doesn’t check orders thoroughly; a barista might mistakenly serve a drink with an extra shot of chaos instead of espresso. If someone slips a malicious command through the system, it could brew a whole pot of trouble. The vulnerability arises from improper input sanitization in the embedded web server of Lexmark devices, allowing remote code execution if crafted inputs are sent to these devices.

What to do

An attacker with knowledge of this vulnerability could gain control over the device, leading to unauthorized actions such as running malicious code or altering printer settings. This could result in data leaks or even leverage the device for larger network attacks, making it a surprisingly sneaky risk if left unchecked. To secure your Lexmark devices, ensure you update them to the latest firmware version as soon as it's available. Additionally, restrict access to the web interface and regularly audit your network to detect any unauthorized access attempts. You've got this! With a few proactive steps, you can keep your devices safe and sound. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.06215 · 93.5th percentile
Published
2022-01-20T16:11Z
EPSS history
Timeline
  • 20 JAN 16:11Z
    Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device
    cvelistv5