ZDI-CAN-25848: ZDI-25-220: (Pwn2Own) Lexmark CX331adwe basic_auth.cgi PATH_TRANSLATED Directory Traversal Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of ZDI-CAN-25848?
The ZDI-CAN-25848 vulnerability has been assigned a CVSS rating of 6.3, indicating moderate severity.
How does ZDI-CAN-25848 affect Lexmark CX331adwe printers?
ZDI-CAN-25848 allows network-adjacent attackers to execute arbitrary code on affected installations of Lexmark CX331adwe printers.
Is authentication required to exploit ZDI-CAN-25848?
No, authentication is not required to exploit the ZDI-CAN-25848 vulnerability.
What are the implications of a successful exploitation of ZDI-CAN-25848?
Successful exploitation of ZDI-CAN-25848 could allow attackers to gain control over the affected printer, risking data confidentiality and integrity.
How can organizations protect against ZDI-CAN-25848?
Organizations can protect against ZDI-CAN-25848 by implementing network segmentation, restricting access to the vulnerable printer, and applying any available security patches.