CVE-2021-44737
📋 TL;DR
This CVE describes a PJL directory traversal vulnerability in Lexmark printers and multifunction devices that allows attackers to overwrite internal configuration files. The vulnerability affects Lexmark devices through December 7, 2021, potentially enabling unauthorized configuration changes or device compromise.
💻 Affected Systems
- Lexmark printers
- Lexmark multifunction devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device takeover, persistent backdoor installation, or device bricking through malicious configuration file overwrites.
Likely Case
Unauthorized configuration changes, service disruption, or credential theft from configuration files.
If Mitigated
Limited impact with proper network segmentation and access controls preventing unauthorized PJL access.
🎯 Exploit Status
Exploitation requires network access to the device's PJL port (typically 9100/tcp).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates released after 2021-12-07
Vendor Advisory: https://support.lexmark.com/alerts/
Restart Required: Yes
Instructions:
1. Check Lexmark support site for your specific device model. 2. Download latest firmware. 3. Apply firmware update following manufacturer instructions. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to PJL port (9100/tcp) to authorized systems only
firewall rules to block 9100/tcp from untrusted networks
Disable PJL
allDisable PJL protocol if not required for business operations
Device configuration: Disable PJL in printer settings
🧯 If You Can't Patch
- Segment printers on isolated network VLAN
- Implement strict firewall rules blocking external access to printer ports
🔍 How to Verify
Check if Vulnerable:
Check device firmware version date - if before 2021-12-07, likely vulnerable. Test PJL access to port 9100.Check Version:
Check printer web interface or control panel for firmware version/dateVerify Fix Applied:
Verify firmware version is post-2021-12-07. Test that directory traversal attempts via PJL are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual PJL commands in printer logs
- Configuration file modification events
- Multiple failed PJL access attempts
Network Indicators:
- Traffic to printer port 9100/tcp from unusual sources
- PJL commands containing directory traversal patterns (../)
SIEM Query:
source_port:9100 AND (payload_contains:"../" OR payload_contains:"..\\")