A researcher has disclosed the details of an unpatched vulnerability that was expected to pose a serious threat to many Linux systems.
The post Highly Anticipated Linux Flaw Allows Remote Code Execution, but Less Serious Than Expected appeared first on SecurityWeek.
Canon announces patches for seven critical-severity remote code execution flaws impacting small office printer models.
The post Canon Patches 7 Critical Vulnerabilities in Small Office Printers appeared first on SecurityWeek.
An improper input validation flaw in Kyocera Device Manager allows attackers to capture credentials, compromise accounts.
The post Kyocera Device Manager Vulnerability Exposes Enterprise Credentials appeared first on SecurityWeek.
A new vulnerability in the PaperCut MF/NG print management software can be exploited for unauthenticated, remote code execution.
The post New PaperCut Vulnerability Allows Remote Code Execution appeared first on SecurityWeek.
Print management solutions provider PaperCut warns that exploitation of a recently patched vulnerability has commenced.
The post PaperCut Warns of Exploited Vulnerability in Print Management Solutions appeared first on SecurityWeek.
Printer and imaging products manufacturer Lexmark this week published a security advisory to warn users of a critical vulnerability impacting over 120 printer models.
The issue, tracked as CVE-2023-23560 (CVSS score of 9.0), is described as a server-side request forgery (SSRF) flaw in the Web Services feature of newer Lexmark devices, which could be exploited to execute arbitrary code.
“Successful exploitation of this vulnerability can lead to an attacker being able to remotely execute arbitrary code on a device,” Lexmark warns in an advisory (PDF).
The manufacturer lists roughly 125 device models that are impacted by the security defect, including B, C, CS, CX, M, MB, MC, MS, MX, XC, and XM series printers.
The company has announced firmware updates that resolve the vulnerability on all impacted devices and encourages users to find update instructions on its support website.
Additionally, Lexmark says that exploitation of CVE-2023-23560 can be blocked by disabling the Web Services feature on the vulnerable printers (TCP port 65002).
To block TCP port 65002, users would have to go to Settings > Network/Ports > TCP/IP > TCP/IP Port Access, uncheck TCP 65002 ( WSD Print Service ), and then click Save.
Lexmark also warns that, while it is not aware of any malicious attacks targeting the vulnerability, proof-of-concept (PoC) code exploiting it has been made public.
Given that it is not unusual for threat actors to target unpatched printers and other Internet of Things (IoT) devices, users are advised to apply the available patches as soon as possible.
Related: Hundreds of Thousands of Konica Printers Vulnerable to Hacking via Physical Access
Related: Serious Vulnerability Exploited at Hacking Contest Impacts Over 200 HP Printers
Related: Xerox Quietly Patched Device-Bricking Flaw Affecting Some Printers
The post Critical Vulnerability Impacts Over 120 Lexmark Printers appeared first on SecurityWeek.
