Lexmark has published several security warnings about recently disclosed vulnerabilities in Lexmark print software and firmware. Patches are provided and customers are asked to update their devices and software immediately to protect them against potential attacks.

The details:

• Vulnerabilities were found in Lexmark's print management software, embedded web server, and firmware.
• Lexmark says it is not aware of exploits in the wild.
• Security patches are available.

Two of the security vulnerabilities have received an aggregate severity rating of critical.

Critical vulnerability in Lexmark Print Management Client

Quick solution: update the client software to version 3.5.0.0 or later.

CVE-2025-1126 has a CVSS rating of 9.3. It is a vulnerability in Lexmark's Print Management client. Lexmark confirms that the issue affects the software on Windows, macOS, and Linux.

Lexmark describes it as a reliance on untrusted inputs vulnerability in the client, but does not provide additional information in the security notice. Successful exploitation could lead to the launch of arbitrary processes under System or root contexts, or the deletion of folders, including "folders that require typically Administrator or other elevated permissions to access".

The security issue affects versions 3.0.0 to 3.4.0 of the Lexmark Print Management Client. Lexmark recommends that affected customers update to the latest version of the client software. The process is explained on Lexmark's Support website.

Critical vulnerability in web server

Quick solution: set a password to prevent unauthorized access and update firmware.

CVE-2024-11348 is the second critical vulnerability. It has a CVSS base score of 9.1. Lexmark describes it as a "combination Path Traversal and Concurrent Execution vulnerability" in the embedded web server of Lexmark devices.

Successful exploitation of the issue can lead to remote execution of arbitrary code on vulnerable devices. Lexmark lists all affected printers in a support document.

Lexmark recommends updating the firmware of affected printers. Administrators may also set a password on the affected device to prevent untrusted users from executing the vulnerability. Lexmark says that users are prompted to set a password on the initial setup.

Four vulnerabilities rated high

Quick solution: Lexmark recommends upgrading the firmware of affected devices, provided that a firmware upgrade is available.

Lexmark furthermore confirmed four security issues in the Postscript interpreter in company devices.

• CVE-2024-11344 -- A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices.
• CVE-2024-11345 -- A heap-based memory vulnerability has been identified in the Postscript interpreter in various Lexmark devices.
• CVE-2024-11346 -- A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices.
• CVE-2024-11347 -- An integer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices.

The vulnerabilities can be exploited to execute arbitrary code as an unprivileged user. Upgrading the firmware resolves the security issues.