What’s Vulnerable › Vulnerabilities

CVE-2021-44735

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-20 · updated 2026-06-17
• Weakness: CWE-77

Description

Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.

Affected products

• Lexmark B2236 Firmware: before mslsg.076.294 — fixed in mslsg.076.294
• Lexmark B2338 Firmware: before msngm.076.294 — fixed in msngm.076.294
• Lexmark B2442 Firmware: before msngm.076.294 — fixed in msngm.076.294
• Lexmark B2546 Firmware: before msngm.076.294 — fixed in msngm.076.294
• Lexmark B2650 Firmware: before msngm.076.294 — fixed in msngm.076.294
• Lexmark B2865 Firmware: before msngw.076.294 — fixed in msngw.076.294
• Lexmark B3340 Firmware: before mslbd.076.294 — fixed in mslbd.076.294
• Lexmark B3442 Firmware: before mslbd.076.294 — fixed in mslbd.076.294
• Lexmark C2240 Firmware: before cstzj.076.294 — fixed in cstzj.076.294
• Lexmark C2325 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
• Lexmark C2326 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
• Lexmark C2425 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
• Lexmark C2535 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
• Lexmark C3224 Firmware: before cslbl.076.294 — fixed in cslbl.076.294
• Lexmark C3326 Firmware: before cslbl.076.294 — fixed in cslbl.076.294
• Lexmark C3426 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
• Lexmark C4150 Firmware: before cstat.076.294 — fixed in cstat.076.294
• Lexmark C6160 Firmware: before cstpp.076.294 — fixed in cstpp.076.294
• Lexmark C9235 Firmware: before cstmh.076.294 — fixed in cstmh.076.294
• Lexmark Cs331 Firmware: before cslbl.076.294 — fixed in cslbl.076.294
• Lexmark Cs421 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
• Lexmark Cs431 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
• Lexmark Cs439 Firmware: before cslbn.076.294 — fixed in cslbn.076.294
• Lexmark Cs521 Firmware: before csnzj.076.294 — fixed in csnzj.076.294
• Lexmark Cs622 Firmware: before cstzj.076.294 — fixed in cstzj.076.294
• Lexmark Cs720 Firmware: before cstat.076.294 — fixed in cstat.076.294
• Lexmark Cs725 Firmware: before cstat.076.294 — fixed in cstat.076.294
• Lexmark Cs727 Firmware: before cstat.076.294 — fixed in cstat.076.294
• Lexmark Cs728 Firmware: before cstat.076.294 — fixed in cstat.076.294
• Lexmark Cs820 Firmware: before cstpp.076.294 — fixed in cstpp.076.294

How to fix

Upgrade to a fixed version: Lexmark B2236 Firmware mslsg.076.294; Lexmark B2338 Firmware msngm.076.294; Lexmark B2442 Firmware msngm.076.294; Lexmark B2546 Firmware msngm.076.294; Lexmark B2650 Firmware msngm.076.294; Lexmark B2865 Firmware msngw.076.294; Lexmark B3340 Firmware mslbd.076.294; Lexmark B3442 Firmware mslbd.076.294; Lexmark C2240 Firmware cstzj.076.294; Lexmark C2325 Firmware csnzj.076.294; Lexmark C2326 Firmware cslbn.076.294; Lexmark C2425 Firmware csnzj.076.294. Check the vendor advisory for mitigations.

References

• https://support.lexmark.com/alerts/
• https://www.zerodayinitiative.com/advisories/ZDI-22-326/
• https://www.zerodayinitiative.com/advisories/ZDI-22-329/
• https://www.zerodayinitiative.com/advisories/ZDI-22-330/
• https://support.lexmark.com/alerts/
• https://www.zerodayinitiative.com/advisories/ZDI-22-326/
• https://www.zerodayinitiative.com/advisories/ZDI-22-329/
• https://www.zerodayinitiative.com/advisories/ZDI-22-330/

Get alerted when CVE-2021-44735 or the next vulnerability affects your stack