A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.
Priority LOW 20CWE-1328Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00271 19th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lexmark | Printer Firmware | up to 230.041; 230.075 – 230.086; 230.100 – 230.104; 230.200 – 230.209 | — | No fix listed | CNA |
- Printer Firmware VendorLexmark Affected up to 230.041; 230.075 – 230.086; 230.100 – 230.104; 230.200 – 230.209 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-50738
- 2026-10-03 Alias added: GHSA-56mc-fpwx-p947
More Lexmark vulnerabilities
- TI-2014-07170 Directory traversal vulnerability in the GfdFileUploadServerlet servlet in Lexmark… CVSS 3.1CRITICAL 9.8
- TI-2023-09391 In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. CVSS 3.1CRITICAL 9.8
- TI-2023-11301 Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). CVSS 3.1CRITICAL 9.8
- TI-2023-11300 Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). CVSS 3.1HIGH 8.1
- TI-2023-09090 Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. CVSS 3.1HIGH 7.5
- TI-2021-20249 Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. CVSS 3.1CRITICAL 9.8
Sources
- CVE-2023-50738 · CVE Program
- CVE-2023-50738 · NVD
- FIRST EPSS
- GHSA-56mc-fpwx-p947 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences