Lexmark: Firmware update to fix Windows bug and vulnerability CVE-2022-29850 in mid-Sept. 2022

guest · Sep 6, 2022

by guenni - September 6, 2022

Printer manufacturer Lexmark warned of a vulnerability in more than a hundred of its printer models as early as June 2022. Attackers who have already gained access to the firmware of the printers can then infiltrate there via a vulnerability.

However, the whole thing only became public at the end of August 2022 through an entry in the CVE database. The manufacturer wants to provide a corresponding firmware update by mid-September 2022. Furthermore, I have the information that the USB communication problem of Lexmark printers should also be fixed with this firmware update. This occurred after the July 2022 patch Tuesday and causes Lexmark printers to output only unintelligible characters.
Click to expand...

Firmware vulnerability in 100 models
In Lexmark Security Advisory CVE-2022-29850 (PDF, published in June 2022), the manufacturer writes that the Lexmark firmware is stored in a compressed read-only file system.

However, there is a vulnerability in older firmware versions that allows an attacker to modify the internal configuration files. However, this assumes that the attacker has already compromised the device and is therefore able to change the configuration files. In this case, there would be a risk of making this compromise permanent, i.e., after rebooting the device, it would remain compromised.
Click to expand...

It is important to note that the vulnerability cannot be used to compromise the printer – but the attacker must have previously nested in RAM by other means. Nevertheless, Lexmark rates the vulnerability with a CVSSv3 Base Score 9.8, with exploitability considered low (3.9). Successful exploitation of this vulnerability could lead to the installation of a persistent backdoor on the affected device, the vendor writes.
Click to expand...

Log in or Sign up

Lexmark: Firmware update to fix Windows bug and vulnerability CVE-2022-29850 in mid-Sept. 2022

guest Guest

Log in or Sign up

Lexmark: Firmware update to fix Windows bug and vulnerability CVE-2022-29850 in mid-Sept. 2022

guest Guest

Useful Searches