TL;DR

Lexmark CX532adwe printer is vulnerable to a type confusion exploit enabling RCE without authentication, rated CVSS 8.8 by ZDI.

What happened

['Remote code execution vulnerability found in Lexmark CX532adwe usecmap component', 'Attackers can execute arbitrary commands on the device without needing credentials']

Why it matters for ops

['Lack of proper validation and sanitization in usecmap processing', 'Permissive access control configuration allowing network-adjacent attacks']

Mitigation

  • Apply security patches for Lexmark CX532adwe as soon as they are available
  • Configure firewalls to restrict access to the printer's network

Action items

  • Check if devices are impacted and assess exposure risk
  • Update firmware and apply security updates immediately

Detection IOCs

  • Unusual outbound HTTP requests from printer IP
  • Unexpected authentication attempts on remote interfaces

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-065/