Read the docs
TI-2022-15683 Aliases CVE-2022-34887GHSA-fcv4-fw97-74j9

Improper authentication in Lenovo Printer GM265DN

Priority LOW 24CWE-287Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.

Summary

Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the administrator password.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0032 25th percentileScored 2026-11-07
Fix Fixed Printer GM265DN (production date June 2022 and before) (Lenovo): 01.00.20NPrinter GM265DN (production date July 2022 and later) (Lenovo): 01.17.00.03.00+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoPrinter GM265DN (production date June 2022 and before) to before 01.00.20N01.00.20NPatch availableCNA
LenovoPrinter GM265DN (production date July 2022 and later) to before 01.17.00.03.00 01.17.00.03.00Patch availableCNA
LenovoPrinter GM266DNS to before 02.06.00.04.0002.06.00.04.00Patch availableCNA
LenovoPrinter G263DNS to before 02.06.00.04.0002.06.00.04.00Patch availableCNA
  • Printer GM265DN (production date June 2022 and before) VendorLenovo Affected to before 01.00.20N Fixed in 01.00.20N Patch available CNA
  • Printer GM265DN (production date July 2022 and later) VendorLenovo Affected to before 01.17.00.03.00 Fixed in 01.17.00.03.00 Patch available CNA
  • Printer GM266DNS VendorLenovo Affected to before 02.06.00.04.00 Fixed in 02.06.00.04.00 Patch available CNA
  • Printer G263DNS VendorLenovo Affected to before 02.06.00.04.00 Fixed in 02.06.00.04.00 Patch available CNA

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:gm265dn_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableLenovo
cpe:2.3:h:lenovo:gm265dn:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:gm266dns_firmware:*:*:*:*:*:*:*:*before 02.06.00.04.00VulnerableLenovo
cpe:2.3:h:lenovo:gm266dns:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
cpe:2.3:o:lenovo:g263dns_firmware:*:*:*:*:*:*:*:*before 02.06.00.04.00VulnerableLenovo
cpe:2.3:h:lenovo:g263dns:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:gm265dn_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:gm265dn:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:gm266dns_firmware:*:*:*:*:*:*:*:* Versions before 02.06.00.04.00 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:gm266dns:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
  • cpe:2.3:o:lenovo:g263dns_firmware:*:*:*:*:*:*:*:* Versions before 02.06.00.04.00 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:g263dns:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

  • Fix · CNA Printer GM265DN (production date June 2022 and before) (Lenovo) Fixed in 01.00.20N
  • Fix · CNA Printer GM265DN (production date July 2022 and later) (Lenovo) Fixed in 01.17.00.03.00
  • Fix · CNA Printer GM266DNS (Lenovo) Fixed in 02.06.00.04.00
  • Fix · CNA Printer G263DNS (Lenovo) Fixed in 02.06.00.04.00

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo Printer G263DNS, Printer GM265DN (production date July 2022 and later) and 2 more products 01.00.20N, 01.17.00.03.00, 02.06.00.04.00

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2022-15682 Buffer overflow in Lenovo Printer GM265DNPriority MEDIUM 42
    • TI-2022-03166 Improper input validation in Lenovo Printer GM265DNPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34887
  2. 2026-10-03 Alias added: GHSA-fcv4-fw97-74j9

References

Patch 1

  • TI-2022-15682 Buffer overflow in Lenovo Printer GM265DN CVSS 3.1HIGH 8.8
  • TI-2022-03166 Improper input validation in Lenovo Printer GM265DN CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences