ZDI-CAN-19859: ZDI-23-663: (Pwn2Own) Lexmark MC3224i pagemaker NAME Type Confusion Remote Code Execution Vulnerability

Published May 17, 2023

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark MC3224i printers. Authentication is not required to exploit this vulnerability.

Affected Software

1 affected component

Lexmark MC3224i

Event History

May 17, 2023

Advisory Published

05:00 AM

Data Sourced

05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-19859?

ZDI-CAN-19859 is considered a critical vulnerability due to its ability to allow arbitrary code execution by network-adjacent attackers.

How do I fix ZDI-CAN-19859?

To fix ZDI-CAN-19859, ensure that you update the firmware of your Lexmark MC3224i printer to the latest version provided by Lexmark.

Who is affected by ZDI-CAN-19859?

ZDI-CAN-19859 affects installations of the Lexmark MC3224i printers that are exposed to network adjacency.

Is authentication required to exploit ZDI-CAN-19859?

No, authentication is not required to exploit the ZDI-CAN-19859 vulnerability.

What can attackers do with ZDI-CAN-19859?

Attackers can execute arbitrary code on affected Lexmark MC3224i printers, compromising the device's security.