VulnerabilityModified
CVE-2021-42640
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer.
CRITICAL 9.1EPSS 2.04%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.04%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticated attacker to reassign drivers for any printer.
- CVSS 3.1
- 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- EPSS
- 2.04% probability · 80th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-668
- Affected
- printerlogic/web stack
- Source
- cve@mitre.org
References
- https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpointsThird Party Advisory
- https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.htmlThird Party Advisory
- https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suiteThird Party Advisory
- https://www.printerlogic.com/security-bulletin/Vendor Advisory
- https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suiteThird Party Advisory
- https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/Exploit, Third Party Advisory
- https://portswigger.net/daily-swig/printerlogic-vendor-addresses-triple-rce-threat-against-all-connected-endpointsThird Party Advisory
- https://securityaffairs.co/wordpress/127194/security/printerlogic-printer-management-suite-flaws.htmlThird Party Advisory
- https://thecyberthrone.in/2022/01/26/printerlogic-%F0%9F%96%A8-fixes-critical-vulnerabilities-in-its-suite/?utm_source=rss&utm_medium=rss&utm_campaign=printerlogic-%25f0%259f%2596%25a8-fixes-critical-vulnerabilities-in-its-suiteThird Party Advisory
- https://www.printerlogic.com/security-bulletin/Vendor Advisory
- https://www.securityweek.com/printerlogic-patches-code-execution-flaws-printer-management-suiteThird Party Advisory
- https://www.yahooinc.com/paranoids/paranoids-vulnerability-research-printerlogic-issues-security-alert/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.