The company has released several new Security Advisory notices, warning of vulnerabilities identified in various Lexmark devices.
One of the latest Security Advisory notices is warning of an input validation vulnerability has been identified in the web API of newer Lexmark devices.
Lexmark explains that an input validation vulnerability has been identified in the SNMP feature in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. Affected devices are found here.
Also found was that the embedded web server in newer Lexmark devices fails to properly sanitise input data which can lead to remote code execution on the device.
Lexmark advised that a vulnerability has been identified in the embedded web server used in Lexmark devices. The vulnerability allows the attacker to execute arbitrary code on a device with the permissions of the embedded webserver. Affected devices can be seen here.
Another Security Advisory notice reports of a trusted internal component of Lexmark devices that has an input validation vulnerability. This vulnerability can be leveraged by an attacker who has already compromised the device to escalate privileges. This input validation vulnerability allows an attacker who has already compromised an affected Lexmark device to escalate privileges. Affected devices can be found here.
And finally, a vulnerability has been identified in the Postscript interpreter in various Lexmark devices. The company explained that a type confusion vulnerability has been identified in Postscript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. See affected devices here.
In all cases, Lexmark recommends a firmware update if your device has affected firmware.
Lexmark added that it is not aware of any malicious use against Lexmark products of the vulnerability described in any of the advisories.
