CVE-2021-44738
📋 TL;DR
A buffer overflow vulnerability in Lexmark printer postscript interpreters allows remote code execution. Attackers can exploit this by sending specially crafted print jobs to affected Lexmark devices. Organizations using Lexmark printers through 2021-12-07 are vulnerable.
💻 Affected Systems
- Lexmark printers with postscript interpreter
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to persistent attacker access, lateral movement into corporate networks, and data exfiltration.
Likely Case
Remote code execution allowing attackers to disrupt printing services, install malware, or use devices as network footholds.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation attempts.
🎯 Exploit Status
Multiple ZDI advisories indicate weaponization likely. Exploitation requires sending malicious print job.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates after 2021-12-07
Vendor Advisory: https://support.lexmark.com/alerts/
Restart Required: Yes
Instructions:
1. Visit Lexmark support site. 2. Identify your printer model. 3. Download latest firmware. 4. Upload firmware to printer via web interface. 5. Reboot printer.
🔧 Temporary Workarounds
Disable PostScript
allDisable PostScript interpreter if not required for printing needs
Network Segmentation
allIsolate printers on separate VLAN with restricted access
🧯 If You Can't Patch
- Implement strict network access controls allowing only trusted hosts to communicate with printers
- Monitor printer network traffic for anomalous print job patterns
🔍 How to Verify
Check if Vulnerable:
Check firmware version date in printer web interface. If before 2021-12-07, likely vulnerable.Check Version:
Check via printer web interface: Settings > Device > About or similar menuVerify Fix Applied:
Confirm firmware version date is after 2021-12-07 in printer settings.📡 Detection & Monitoring
Log Indicators:
- Unusual print job failures
- PostScript interpreter crashes
- Multiple failed print attempts from single source
Network Indicators:
- Large or malformed print jobs to Lexmark printers
- Unexpected network connections from printers
SIEM Query:
source="printer_logs" AND (event="postscript_error" OR event="buffer_overflow")🔗 References
- https://support.lexmark.com/alerts/
- https://www.zerodayinitiative.com/advisories/ZDI-22-327/
- https://www.zerodayinitiative.com/advisories/ZDI-22-328/
- https://www.zerodayinitiative.com/advisories/ZDI-22-382/
- https://support.lexmark.com/alerts/
- https://www.zerodayinitiative.com/advisories/ZDI-22-327/
- https://www.zerodayinitiative.com/advisories/ZDI-22-328/
- https://www.zerodayinitiative.com/advisories/ZDI-22-382/
