CVE-2016-1896
Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.26% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-254, CWE-264
- Affected
- lexmark/printer firmware
- Source
- cve@mitre.org
References
- http://support.lexmark.com/index?page=content&id=TE745Vendor Advisory
- http://support.lexmark.com/index?page=content&id=TE745Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.