Lexmark , an American company that manufactures laser printers and imaging products, has released a security firmware update to address a serious vulnerability that allows remote code execution in over 100 printer models . Act quickly and update your firmware now!
The vulnerability is tracked as CVE-2023-23560 and, according to the company, is rated 9.0 in severity. It is a server-side request forgery (SSRF) in the Web Services feature of Lexmark devices.
See also: Realtek SDK vulnerability used in 134 million attacks
At this time, there is no evidence that the vulnerability has been exploited. Lexmark says the flaw could be exploited to achieve code execution on a device, and this could have a broader impact on an organization.
Although there is currently no active exploitation, proof of concept (PoC) exploit code has been published, which means that exploitation may be a matter of time and users should immediately apply the new security firmware update for Lexmark printers.
The company says there are more than 100 printer models that are affected if they run a vulnerable firmware version. Users to check their firmware level and make sure it matches an update that addresses the issue.
A full list of potentially affected devices, the vulnerable firmware versions, and the update that fixes the issue is available in Lexmark's security advisory
See also: FBI hacked into Hive ransomware group's systems
This vulnerability could give attackers access to print jobs, let them obtain credentials to the network the printer is connected to, and potentially allow them to expand to other devices in the same department.
The CVE-2023-23560 vulnerability affects a large number of Lexmark printers, so owners of such devices are advised to update systems .
Firmware check
In general, all firmware versions with number 081.233 and below are vulnerable, while the versions that address the issue are from 0.81.234 and above.
To check which firmware device , go to “Settings → Reports → Menu Setting Page” and check the version listed under “Device Information”.
To obtain a copy of the latest firmware version for your printer model, visit Lexmark's official download portal.
For those who cannot apply the update , Lexmark recommends disabling the Web Services feature on TCP port 65002, blocking the ability to exploit the CVE-2023-23560 vulnerability.
See also: CISA: Cyberattacks exploit legitimate remote monitoring software
To do this, go to “Settings → Network/Ports → TCP/IP → TCP/IP Port Access“, uncheck “TCP 65002 (WSD Print Service)” and save the changes.
Printer devices are often neglected when it comes to implementing good security.
However, users should take care of the security of all their devices and take appropriate measures, such as regularly applying security, using strong administrator credentials, and disabling unused services that access the web.
Source: www.bleepingcomputer.com
