CVE-2021-44734

CWE-94 — Code Injection CWE-20 — Improper Input Validation3 documents3 sources

Severity

9.8CRITICAL

EPSS

12.8%

top 5.96%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

234

Lexmark 6500e Firmware Lexmark B2236 Firmware Lexmark B2338 Firmware +231 more

Timeline

PublishedJan 20

Latest updateJan 21

Description

Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages234 packages

▶NVDlexmark/c734_firmware< lr.sk.p835

▶NVDlexmark/c736_firmware< lr.ske.p835

▶NVDlexmark/c746_firmware< lhs60.cm2.p753

▶NVDlexmark/c748_firmware< lhs60.cm4.p753

▶NVDlexmark/c792_firmware< lhs60.hc.p753

🔴Vulnerability Details

GHSA

GHSA-j6rg-mpmv-h73q: Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the d↗2022-01-21

▶

CVEList

CVE-2021-44734: Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the d↗2022-01-20

▶