vulnwire
9.1crit

CVE-2023-50737

An input validation vulnerability in the SE Menu allows an attacker to execute arbitrary code.

Published 2 y ago · modified 4 mo ago · JSON

CVSS
9.1
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known

The SE menu contains information used by Lexmark to diagnose device errors. A vulnerability in one of the SE menu routines can be leveraged by an attacker to execute arbitrary code.

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CNA3.19.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Lexmark various
  • lexmark cxtpc_firmware
  • lexmark cstpc_firmware
  • lexmark mxtct_firmware
  • lexmark mxtpm_firmware
  • lexmark cxtmm_firmware
  • lexmark mslsg_firmware
  • lexmark mxlsg_firmware
  • lexmark mslbd_firmware
  • lexmark mxlbd_firmware
  • lexmark msngm_firmware
  • lexmark mstgm_firmware
  • lexmark mxngm_firmware
  • lexmark ms315
  • lexmark ms610dn
  • lexmark mxtgm_firmware
  • lexmark msngw_firmware
  • lexmark mstgw_firmware
  • lexmark mxtgw_firmware
  • lexmark cslbn_firmware
  • lexmark cslbl_firmware
  • lexmark cxlbn_firmware
  • lexmark cxlbl_firmware
  • lexmark cstzj_firmware
  • lexmark csnzj_firmware
  • lexmark cxtzj_firmware
  • lexmark cxnzj_firmware
  • lexmark cxtpp_firmware
  • lexmark cstpp_firmware
  • lexmark cstat_firmware
  • lexmark cxtat_firmware
  • lexmark cstmh_firmware
  • lexmark cxtmh_firmware
  • lexmark msnsn_firmware
  • lexmark mstsn_firmware
  • lexmark cx410
  • lexmark mxtsn_firmware
  • lexmark csngv_firmware
  • lexmark cstgv_firmware
  • lexmark cxtgv_firmware
  • lexmark ms610de
  • lexmark mx410
  • lexmark mx610
  • lexmark ms711
  • lexmark ms810de
  • lexmark ms812de
  • lexmark mx710
  • lexmark ms911
  • lexmark mx910
  • lexmark mx6500e

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • lexmark.com /en_us/solutions/security/lexmark-security-advisories.html · vendor-advisory, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.