CVE-2021-44734

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 6.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-20 · updated 2026-06-17
Weakness: CWE-94

Description

Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07, which can which can lead to remote code execution on the device.

Affected products

Lexmark 6500E Firmware: before lhs60.jr.p753 — fixed in lhs60.jr.p753
Lexmark B2236 Firmware: before mslsg.076.294 — fixed in mslsg.076.294
Lexmark B2338 Firmware: before msngm.076.294 — fixed in msngm.076.294
Lexmark B2442 Firmware: before msngm.076.294 — fixed in msngm.076.294
Lexmark B2546 Firmware: before msngm.076.294 — fixed in msngm.076.294
Lexmark B2650 Firmware: before msngm.076.294 — fixed in msngm.076.294
Lexmark B2865 Firmware: before msngw.076.294 — fixed in msngw.076.294
Lexmark B3340 Firmware: before mslbd.076.294 — fixed in mslbd.076.294
Lexmark B3442 Firmware: before mslbd.076.294 — fixed in mslbd.076.294
Lexmark C2132 Firmware: before lw80.vy4.p210 — fixed in lw80.vy4.p210
Lexmark C2240 Firmware: before cstzj.076.294 — fixed in cstzj.076.294
Lexmark C2325 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
Lexmark C2326 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
Lexmark C2425 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
Lexmark C2535 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
Lexmark C3224 Firmware: before cslbl.076.294 — fixed in cslbl.076.294
Lexmark C3326 Firmware: before cslbl.076.294 — fixed in cslbl.076.294
Lexmark C3426 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
Lexmark C4150 Firmware: before cstat.076.294 — fixed in cstat.076.294
Lexmark C6160 Firmware: before cstpp.076.294 — fixed in cstpp.076.294
Lexmark C734 Firmware: before lr.sk.p835 — fixed in lr.sk.p835
Lexmark C736 Firmware: before lr.ske.p835 — fixed in lr.ske.p835
Lexmark C746 Firmware: before lhs60.cm2.p753 — fixed in lhs60.cm2.p753
Lexmark C748 Firmware: before lhs60.cm4.p753 — fixed in lhs60.cm4.p753
Lexmark C792 Firmware: before lhs60.hc.p753 — fixed in lhs60.hc.p753
Lexmark C9235 Firmware: before cstmh.076.294 — fixed in cstmh.076.294
Lexmark C925 Firmware: before lhs60.hv.p753 — fixed in lhs60.hv.p753
Lexmark C950 Firmware: before lhs60.tp.p753 — fixed in lhs60.tp.p753
Lexmark Cs310 Firmware: before lw80.vyl.p210 — fixed in lw80.vyl.p210
Lexmark Cs317 Firmware: before lw80.vyl.p210 — fixed in lw80.vyl.p210

How to fix

Upgrade to a fixed version: Lexmark 6500E Firmware lhs60.jr.p753; Lexmark B2236 Firmware mslsg.076.294; Lexmark B2338 Firmware msngm.076.294; Lexmark B2442 Firmware msngm.076.294; Lexmark B2546 Firmware msngm.076.294; Lexmark B2650 Firmware msngm.076.294; Lexmark B2865 Firmware msngw.076.294; Lexmark B3340 Firmware mslbd.076.294; Lexmark B3442 Firmware mslbd.076.294; Lexmark C2132 Firmware lw80.vy4.p210; Lexmark C2240 Firmware cstzj.076.294; Lexmark C2325 Firmware csnzj.076.294. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-44734 or the next vulnerability affects your stack