H3-2022-0096¶
Lexmark Printer Command Injection Vulnerability
| Category | VULNERABILITY |
| Base Score | 9.8 |
Description¶
In Lexmark printers, there exists a vulnerable web page that allows attackers to inject arbitrary commands by sending a crafted web request. This is a 0-day vulnerability that has been disclosed by the Horizon3 Attack Team to Lexmark and is in the process of being patched in a future Lexmark firmware update.
Impact¶
Attackers can inject arbitrary commands and take over the device, carrying out actions such as dumping local and service credentials and accessing printed documents.