CVE-2023-23560

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-01-23 · updated 2026-06-17
Weakness: CWE-918

Description

In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.

Affected products

Lexmark B2236 Firmware: before mslsg.081.234 — fixed in mslsg.081.234
Lexmark B2338 Firmware: before msngm.081.234 — fixed in msngm.081.234
Lexmark B2442 Firmware: before msngm.081.234 — fixed in msngm.081.234
Lexmark B2546 Firmware: before msngm.081.234 — fixed in msngm.081.234
Lexmark B2650 Firmware: before msngm.081.234 — fixed in msngm.081.234
Lexmark B2865 Firmware: before msngw.081.234 — fixed in msngw.081.234
Lexmark B3340 Firmware: before mslbd.081.234 — fixed in mslbd.081.234
Lexmark B3442 Firmware: before mslbd.081.234 — fixed in mslbd.081.234
Lexmark C2240 Firmware: before cstzj.081.234 — fixed in cstzj.081.234
Lexmark C2325 Firmware: before csnzj.081.234 — fixed in csnzj.081.234
Lexmark C2326 Firmware: before cslbn.081.234 — fixed in cslbn.081.234
Lexmark C2425 Firmware: before csnzj.081.234 — fixed in csnzj.081.234
Lexmark C2535 Firmware: before csnzj.081.234 — fixed in csnzj.081.234
Lexmark C3224 Firmware: before cslbl.081.234 — fixed in cslbl.081.234
Lexmark C3326 Firmware: before cslbl.081.234 — fixed in cslbl.081.234
Lexmark C3426 Firmware: before cslbn.081.234 — fixed in cslbn.081.234
Lexmark C4150 Firmware: before cstat.081.234 — fixed in cstat.081.234
Lexmark C6160 Firmware: before cstpp.081.234 — fixed in cstpp.081.234
Lexmark C9235 Firmware: before cstmh.081.234 — fixed in cstmh.081.234
Lexmark Cs331 Firmware: before cslbl.081.234 — fixed in cslbl.081.234
Lexmark Cs421 Firmware: before csnzj.081.234 — fixed in csnzj.081.234
Lexmark Cs431 Firmware: before cslbn.081.234 — fixed in cslbn.081.234
Lexmark Cs439 Firmware: before cslbn.081.234 — fixed in cslbn.081.234
Lexmark Cs521 Firmware: before csnzj.081.234 — fixed in csnzj.081.234
Lexmark Cs622 Firmware: before cstzj.081.234 — fixed in cstzj.081.234
Lexmark Cs720 Firmware: before cstat.081.234 — fixed in cstat.081.234
Lexmark Cs725 Firmware: before cstat.081.234 — fixed in cstat.081.234
Lexmark Cs727 Firmware: before cstat.081.234 — fixed in cstat.081.234
Lexmark Cs728 Firmware: before cstat.081.234 — fixed in cstat.081.234
Lexmark Cs820 Firmware: before cstpp.081.234 — fixed in cstpp.081.234

How to fix

Upgrade to a fixed version: Lexmark B2236 Firmware mslsg.081.234; Lexmark B2338 Firmware msngm.081.234; Lexmark B2442 Firmware msngm.081.234; Lexmark B2546 Firmware msngm.081.234; Lexmark B2650 Firmware msngm.081.234; Lexmark B2865 Firmware msngw.081.234; Lexmark B3340 Firmware mslbd.081.234; Lexmark B3442 Firmware mslbd.081.234; Lexmark C2240 Firmware cstzj.081.234; Lexmark C2325 Firmware csnzj.081.234; Lexmark C2326 Firmware cslbn.081.234; Lexmark C2425 Firmware csnzj.081.234. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-23560 or the next vulnerability affects your stack