CVE-2021-44735
📋 TL;DR
This CVE describes a command injection vulnerability in the embedded web server of Lexmark devices. Attackers can execute arbitrary commands on affected devices by sending specially crafted requests. All Lexmark devices with the vulnerable web server component are affected.
💻 Affected Systems
- Lexmark printers and multifunction devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise allowing attackers to execute arbitrary commands, potentially leading to data theft, device takeover, or lateral movement within the network.
Likely Case
Remote code execution leading to device compromise, data exfiltration, or use as a foothold for further network attacks.
If Mitigated
Limited impact if devices are isolated, patched, or have restricted network access, though command injection could still affect device functionality.
🎯 Exploit Status
Multiple ZDI advisories indicate weaponization is likely given the high CVSS score and unauthenticated nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released after 2021-12-07
Vendor Advisory: https://support.lexmark.com/alerts/
Restart Required: Yes
Instructions:
1. Visit Lexmark support site. 2. Identify your device model. 3. Download latest firmware. 4. Apply firmware update via web interface or management tools. 5. Reboot device.
🔧 Temporary Workarounds
Network segmentation
allIsolate Lexmark devices on separate VLANs with restricted access
Disable web interface
allDisable the embedded web server if not required for operations
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor device logs for suspicious command execution attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface or management console. If version date is 2021-12-07 or earlier, device is vulnerable.Check Version:
Check via web interface at http://[device-ip]/settings or using Lexmark management toolsVerify Fix Applied:
Verify firmware version shows date after 2021-12-07 and test web interface functionality.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in device logs
- Multiple failed authentication attempts followed by command execution
Network Indicators:
- HTTP requests with command injection patterns to device web interface
- Unexpected outbound connections from printer devices
SIEM Query:
source="lexmark-device" AND (http_uri="*cmd=*" OR http_uri="*;*" OR http_uri="*|*" OR http_uri="*`*" OR http_uri="*$(*")🔗 References
- https://support.lexmark.com/alerts/
- https://www.zerodayinitiative.com/advisories/ZDI-22-326/
- https://www.zerodayinitiative.com/advisories/ZDI-22-329/
- https://www.zerodayinitiative.com/advisories/ZDI-22-330/
- https://support.lexmark.com/alerts/
- https://www.zerodayinitiative.com/advisories/ZDI-22-326/
- https://www.zerodayinitiative.com/advisories/ZDI-22-329/
- https://www.zerodayinitiative.com/advisories/ZDI-22-330/
