CVE-2023-26070
📋 TL;DR
This CVE describes an input validation vulnerability in certain Lexmark devices that could allow remote attackers to execute arbitrary code or cause denial of service. The vulnerability affects Lexmark devices with firmware versions through February 19, 2023. Organizations using affected Lexmark printers and multifunction devices are at risk.
💻 Affected Systems
- Lexmark printers and multifunction devices
📦 What is this software?
Lp Firmware by Lexmark
Lp Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
Lr Firmware by Lexmark
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full control of the device, potentially pivoting to internal networks or deploying ransomware.
Likely Case
Remote code execution leading to device compromise, data exfiltration, or disruption of printing services.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only denial of service.
🎯 Exploit Status
CVSS 9.8 suggests low attack complexity; no public exploit code known at time of analysis.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions after 2023-02-19
Vendor Advisory: https://publications.lexmark.com/publications/security-alerts/CVE-2023-26070.pdf
Restart Required: Yes
Instructions:
1. Visit Lexmark support site. 2. Identify your device model. 3. Download latest firmware. 4. Apply firmware update via web interface or USB. 5. Reboot device.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Lexmark devices to separate VLAN with restricted access.
Disable Unnecessary Services
allTurn off unused network services on printer web interface.
🧯 If You Can't Patch
- Implement strict network access controls to limit device exposure
- Monitor device logs for suspicious activity and implement IDS/IPS rules
🔍 How to Verify
Check if Vulnerable:
Check firmware version in device web interface under Settings > General Settings > Device InformationCheck Version:
N/A for embedded devices; use web interface or SNMP queryVerify Fix Applied:
Verify firmware version is newer than 2023-02-19 in device information page📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to printer web interface
- Firmware modification attempts
- Unexpected device reboots
Network Indicators:
- Suspicious traffic to printer ports (80, 443, 9100)
- Unusual outbound connections from printer
SIEM Query:
source="lexmark-printer" AND (event_type="firmware_change" OR http_status="500" OR http_method="POST" AND uri_contains("config"))