B2236 Firmware
CVE-2023-23560
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
AnalysisAI
In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Server-Side Request Forgery (SSRF) (CWE-918), which allows attackers to make the server perform requests to unintended internal or external resources. In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. Affected products include: Lexmark B2236 Firmware, Lexmark B2338 Firmware, Lexmark B2442 Firmware, Lexmark B2546 Firmware, Lexmark B2650 Firmware. Version information: through 2023.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and allowlist destination URLs, block requests to internal networks, use network segmentation.
More in B2236 Firmware
View allVarious Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to
Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. Rated high severity (CVSS 7.5), this
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today