10
CVSSv2

CVE-2021-44735

Published: 20/01/2022 Updated: 17/03/2022
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 890
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Summary

This vulnerability allows network-adjacent malicious users to execute arbitrary code on affected installations of Lexmark MC3224i printers. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the processing of packet captures. When parsing the filter property, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the www-data user.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

lexmark b2236_firmware

lexmark mb2236_firmware

lexmark ms431_firmware

lexmark ms331_firmware

lexmark m1342_firmware

lexmark b3442_firmware

lexmark b3340_firmware

lexmark xm1342_firmware

lexmark mx331_firmware

lexmark mx431_firmware

lexmark mb3442_firmware

lexmark ms321_firmware

lexmark ms421_firmware

lexmark ms521_firmware

lexmark ms621_firmware

lexmark m1242_firmware

lexmark m1246_firmware

lexmark b2338_firmware

lexmark b2442_firmware

lexmark b2546_firmware

lexmark b2650_firmware

lexmark ms622_firmware

lexmark m3250_firmware

lexmark mx321_firmware

lexmark mb2338_firmware

lexmark mx421_firmware

lexmark mx521_firmware

lexmark mx522_firmware

lexmark mx622_firmware

lexmark xm1242_firmware

lexmark xm1246_firmware

lexmark xm3250_firmware

lexmark mb2442_firmware

lexmark mb2546_firmware

lexmark mb2650_firmware

lexmark ms821_firmware

lexmark ms823_firmware

lexmark ms825_firmware

lexmark b2865_firmware

lexmark ms725_firmware

lexmark ms822_firmware

lexmark ms826_firmware

lexmark m5255_firmware

lexmark m5270_firmware

lexmark mx722_firmware

lexmark mx822_firmware

lexmark mx826_firmware

lexmark xm5365_firmware

lexmark xm7355_firmware

lexmark xm7370_firmware

lexmark mb2770_firmware

lexmark mx721_firmware

lexmark c3426_firmware

lexmark c2326_firmware

lexmark cs431_firmware

lexmark cs439_firmware

lexmark cs331_firmware

lexmark c3224_firmware

lexmark c3326_firmware

lexmark mc3426_firmware

lexmark cx431_firmware

lexmark xc2326_firmware

lexmark mc3224_firmware

lexmark mc3326_firmware

lexmark cx331_firmware

lexmark cs622_firmware

lexmark c2240_firmware

lexmark cs421_firmware

lexmark cs521_firmware

lexmark c2325_firmware

lexmark c2425_firmware

lexmark c2535_firmware

lexmark cx522_firmware

lexmark cx622_firmware

lexmark cx625_firmware

lexmark xc2235_firmware

lexmark xc4240_firmware

lexmark mc2535_firmware

lexmark mc2640_firmware

lexmark cx421_firmware

lexmark mc2325_firmware

lexmark mc2425_firmware

lexmark cx820_firmware

lexmark cx825_firmware

lexmark cs827_firmware

lexmark cx860_firmware

lexmark xc6152_firmware

lexmark xc6153_firmware

lexmark xc8155_firmware

lexmark xc8160_firmware

lexmark xc8163_firmware

lexmark cs820_firmware

lexmark c6160_firmware

lexmark cs720_firmware

lexmark cs725_firmware

lexmark cs727_firmware

lexmark cs728_firmware

lexmark c4150_firmware

lexmark cx725_firmware

lexmark cx727_firmware

lexmark xc4140_firmware

lexmark xc4143_firmware

lexmark xc4150_firmware

lexmark xc4153_firmware

lexmark cs921_firmware

lexmark cs923_firmware

lexmark cs927_firmware

lexmark c9235_firmware

lexmark cx920_firmware

lexmark cx921_firmware

lexmark cx922_firmware

lexmark cx923_firmware

lexmark cx924_firmware

lexmark xc9225_firmware

lexmark xc9235_firmware

lexmark xc9245_firmware

lexmark xc9255_firmware

lexmark xc9265_firmware

Github Repositories

Exploit for CVE-2021-44735

CVE-2021-44735 PoC Embedded web server command injection vulnerability in Lexmark devices Exploit based on the following research wwwcrowdstrikecom/blog/how-to-compromise-a-printer-in-3-simple-steps/ Using To run the exploit pass 3 arguments: rhost - printer IP-address lhost - IP-address of the interface for reverse-shell connection lport - port number for reverse-