ZDI-26-065: (Pwn2Own) Lexmark CX532adwe usecmap Type Confusion Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX532adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2025-65080.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-26-065?
The severity of ZDI-26-065 is critical due to the potential for remote code execution by network-adjacent attackers.
How do I fix ZDI-26-065?
To fix ZDI-26-065, apply the latest firmware updates provided by Lexmark for the CX532adwe printer.
What potential impact does ZDI-26-065 have on my system?
ZDI-26-065 allows attackers to execute arbitrary code, which can lead to unauthorized access and control over the printer.
Do I need to be authenticated to exploit ZDI-26-065?
No, authentication is not required to exploit ZDI-26-065, making it particularly dangerous.
What type of vulnerability is ZDI-26-065?
ZDI-26-065 is classified as a type confusion vulnerability that can be exploited for remote code execution.