CVE-2023-26067

CVE-2023-34362 通过滥用影响 Lexmark 打印机的命令注入漏洞 CVE-2023-26067，实现凭据转储、反向 Shell 和播放音乐的 POC。 技术分析 该漏洞的技术根因分析可在我们的博客上查看： https://www.horizon3.ai/lexmark-command-injection-vulnerability-zdi-can-19470-pwn2own-toronto-2022 摘要 此 POC 滥用命令注入漏洞，以 httpd 用户身份获取 Shell 转储明文 Active Directory 服务凭据与本地凭据 root@kitploit:...

lexmark

Lexmark 打印机相关 这个仓库包含了我公开发布的所有与 Lexmark 打印机相关的工作。 你们中的大多数人可能是冲着固件解密工具来的；请查看 tools 文件夹。 exploit 文件夹包含了我开发的一个（在当时属于）0day 漏洞利用，它似乎影响了超过 100 种不同的 Lexmark 打印机型号。这个漏洞利用最初是为 Pwn2Own Toronto 2022 开发的，并在实际比赛期间神奇地失败了。ZDI 无论如何都提出要以一个可笑的金额购买这些漏洞，而我很快就忘了他们的报价。 和往常一样：所有内容均按原样分发，不要期待支持/更新。 尽情享用！ -- blasty...

Lexmark Printers Cross-site Scripting (CVE-2013-6033)

Multiple cross-site scripting XSS vulnerabilities on Lexmark W840 through LS.HA.P252, T64x before LS.ST.P344, C935dn through LC.JO.P091, C920 through LS.TA.P152, C53x through LS.SW.P069, C52x through LS.FA.P150, E450 through LM.SZ.P124, E350 through LE.PH.P129, and E250 through LE.PM.P126 printer...

Lexmark Printers Improper Input Validation (CVE-2013-6032)

cgi-bin/postpf/cgi-bin/dynamic/config/config.html on Lexmark X94x before LC.BR.P142, X85x through LC4.BE.P487, X644 and X646 before LC2.MC.P374, X642 through LC2.MB.P318, W840 through LS.HA.P252, T64x before LS.ST.P344, X64xef through LC2.TI.P325, C935dn through LC.JO.P091, C920 through LS.TA.P15...

Lexmark Printers Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2018-15520)

Various Lexmark devices have a Buffer Overflow vulnerability. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505905; scriptversion"1.2";...

Lexmark Printers Cross-site Scripting (CVE-2019-18791)

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. This plugin only works with Tenable.ot. Please visit...

Lexmark Printers Denial of Service (CVE-2019-9931)

Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

Lexmark Printers Improper Input Validation (CVE-2010-0101)

The embedded HTTP server in multiple Lexmark laser and inkjet printers and MarkNet devices, including X94x, W840, T656, N4000, E462, C935dn, 25xxN, and other models, allows remote attackers to cause a denial of service operating system halt via a malformed HTTP Authorization header. This plugin...

Lexmark Printer Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2010-0619)

Stack-based buffer overflow in the base, IPDS DLE, Forms DLE, Barcode DLE, Prescribe DLE, and Printcryption DLE components on certain Lexmark laser printers and multi-function printers allows remote attackers to execute arbitrary code or cause a denial of service device hang via a long argument t...

Lexmark多款产品 安全漏洞

The Lexmark CX410 is a product of the American company Lexmark. The Lexmark CX410 is a printer. The Lexmark CX510 is a multifunctional printer. The Lexmark CX82x is a multifunctional printer. Several products from Lexmark have security vulnerabilities; these vulnerabilities stem from the Postscri...

Lexmark Printers 安全漏洞

The Lexmark Printers are a series of printers produced by the American company Lexmark. There is a security vulnerability in the Lexmark Printers, which stems from an untrusted search path within the embedded solution framework, potentially allowing for the execution of arbitrary code. The...

Lexmark多款产品 安全漏洞

The Lexmark CX410, among others, is a product of the American company Lexmark. The Lexmark CX410 is a printer. The Lexmark CX510 is a multifunctional printer. The Lexmark CX82x is also a multifunctional printer. Several Lexmark products have security vulnerabilities; these vulnerabilities stem fr...

Lexmark多款产品 安全漏洞

The Lexmark CX410, among others, is a product of the American company Lexmark. The Lexmark CX410 is a printer. The Lexmark CX510 is a multifunctional printer. The Lexmark CX82x is also a multifunctional printer. Several Lexmark products have security vulnerabilities; these vulnerabilities stem fr...

CVE-2010-0101

The embedded HTTP server in multiple Lexmark laser and inkjet printers and MarkNet devices, including X94x, W840, T656, N4000, E462, C935dn, 25xxN, and other models, allows remote attackers to cause a denial of service operating system halt via a malformed HTTP Authorization header...

CVE-2019-18791

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser...

Lexmark Printers Improper Validation of Integrity Check Value (CVE-2023-50738)

A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified. Lexmark documentation recommends that access to the Firmware Updates be restricted to trusted personnel. %NASLMINLEVEL 80900 C Tenable, Inc...

Lexmark Printers Integer Overflow or Wraparound (CVE-2023-26065)

An integer overflow vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503905; scriptversion"1.3";...

Lexmark Printers Improper Input Validation (CVE-2023-26070)

An input validation vulnerability has been identified in the SNMP feature in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503895; scriptversion"1.3";...

Lexmark Printers Improper Input Validation (CVE-2023-50737)

The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to execute arbitrary code. Lexmark documentation recommends that access to the SE menu be restricted to trusted personnel. %NASLMINLEVEL 80900...

Lexmark Printers CWE CATEGORY: Pointer Issues (CVE-2023-50735)

A heap corruption vulnerability has been identified in PostScript interpreter in various Lexmark devices. The vulnerability can be leveraged by an attacker to execute arbitrary code. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid503896; scriptversion"1.5";...