ZDI-CAN-25539: ZDI-25-217: (Pwn2Own) Lexmark CX331adwe loadCFFdata Type Confusion Remote Code Execution Vulnerability

Published Apr 9, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-11344.

Affected Software

1 affected component

Lexmark CX331adwe

Event History

Apr 9, 2025

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25539?

The severity of ZDI-CAN-25539 is rated at 8.8 by the ZDI, indicating a high risk of exploitation.

How do I fix ZDI-CAN-25539?

To fix ZDI-CAN-25539, you should update your Lexmark CX331adwe printer to the latest firmware version provided by Lexmark.

Who is affected by ZDI-CAN-25539?

ZDI-CAN-25539 affects installations of Lexmark CX331adwe printers.

Is authentication required to exploit ZDI-CAN-25539?

No, authentication is not required to exploit ZDI-CAN-25539, allowing network-adjacent attackers to carry out the attack.

What type of attack is possible with ZDI-CAN-25539?

ZDI-CAN-25539 allows network-adjacent attackers to execute arbitrary code on affected installations.