| CVE ID | CVE-2023-50738 |
| CVSS SCORE | 6.3, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| AFFECTED VENDORS |
Lexmark |
| AFFECTED PRODUCTS |
CX331adwe |
| VULNERABILITY DETAILS |
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the `/usr/bin/hydra` service, which listens on TCP port 9100 by default. The issue results from the lack of proper validation of a firmware image before using it to perform an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. |
| ADDITIONAL DETAILS |
Lexmark has issued an update to correct this vulnerability. More details can be found at:
https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html |
| DISCLOSURE TIMELINE |
|
| CREDIT | Foundry Zero |
