Sept. 19, 2023, 3:57 p.m. |

Packet Storm

An unauthenticated remote code execution vulnerability exists in the embedded webserver in certain Lexmark devices through 2023-02-19. The vulnerability is only exposed if, when setting up the printer or device, the user selects "Set up Later" when asked if they would like to add an Admin user. If no Admin user is created, the endpoint /cgi-bin/fax_change_faxtrace_settings is accessible without authentication. The endpoint allows the user to configure a number of different fax settings. A number of the configurable parameters on …

admin code code execution device devices embedded exposed lexmark printer remote code remote code execution server unauthenticated vulnerability web web server webserver

Business Information Security Officer

@ Metrolink | Los Angeles, CA

Senior Security Engineer

@ Freedom of the Press Foundation | Remote, 4 hour time zone overlap with New York City

Security Engineer

@ ChartMogul | Remote, EU

Malware Reverse Engineer

@ Two Six Technologies | Fort Meade, Maryland

SOC Analyst Level 3

@ OpenBet | Bengaluru, India

Course Developer, Network Security

@ Palo Alto Networks | Plano, TX, United States