What’s Vulnerable › Vulnerabilities

CVE-2023-26068

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 11.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-10 · updated 2026-06-17
• Weakness: CWE-20

Description

Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).

Affected products

• Lexmark Cslbl Firmware: before cslbl.081.232 — fixed in cslbl.081.232
• Lexmark Cslbn Firmware: before cslbn.081.232 — fixed in cslbn.081.232
• Lexmark Csnzj Firmware: before csnzj.081.232 — fixed in csnzj.081.232
• Lexmark Cstat Firmware: before cstat.081.233 — fixed in cstat.081.233
• Lexmark Cstmh Firmware: before cstmh.081.233 — fixed in cstmh.081.233
• Lexmark Cstpc Firmware: before cstpc.081.232 — fixed in cstpc.081.232
• Lexmark Cxlbl Firmware: before cxlbl.081.232 — fixed in cxlbl.081.232
• Lexmark Cxlbn Firmware: before cxlbn.081.232 — fixed in cxlbn.081.232
• Lexmark Cxnzj Firmware: before cxnzj.081.232 — fixed in cxnzj.081.232
• Lexmark Cxtat Firmware: before cxtat.081.233 — fixed in cxtat.081.233
• Lexmark Cxtmm Firmware: before cxtmm.081.232 — fixed in cxtmm.081.232
• Lexmark Cxtpc Firmware: before cxtpc.081.232 — fixed in cxtpc.081.232
• Lexmark Cxtpp Firmware: before cxtpp.081.233; before cstpp.081.233 — fixed in cstpp.081.233, cxtpp.081.233
• Lexmark Cxtzj Firmware: before cxtzj.081.232 — fixed in cxtzj.081.232
• Lexmark Mslbd Firmware: before mslbd.081.232 — fixed in mslbd.081.232
• Lexmark Mslsg Firmware: before mslsg.081.232 — fixed in mslsg.081.232
• Lexmark Msngm Firmware: before msngm.081.232 — fixed in msngm.081.232
• Lexmark Msngw Firmware: before msngw.081.232 — fixed in msngw.081.232
• Lexmark Mstgw Firmware: before mstgw.081.232 — fixed in mstgw.081.232
• Lexmark Mxlbd Firmware: before mxlbd.081.232 — fixed in mxlbd.081.232
• Lexmark Mxlsg Firmware: before mxlsg.081.232 — fixed in mxlsg.081.232
• Lexmark Mxngm Firmware: before mxngm.081.232 — fixed in mxngm.081.232
• Lexmark Mxtct Firmware: before mxtct.081.232 — fixed in mxtct.081.232
• Lexmark Mxtgm Firmware: before mxtgm.081.232 — fixed in mxtgm.081.232
• Lexmark Mxtgw Firmware: before mxtgw.081.232 — fixed in mxtgw.081.232
• Lexmark Mxtpm Firmware: before mxtpm.081.232 — fixed in mxtpm.081.232

How to fix

Upgrade to a fixed version: Lexmark Cslbl Firmware cslbl.081.232; Lexmark Cslbn Firmware cslbn.081.232; Lexmark Csnzj Firmware csnzj.081.232; Lexmark Cstat Firmware cstat.081.233; Lexmark Cstmh Firmware cstmh.081.233; Lexmark Cstpc Firmware cstpc.081.232; Lexmark Cxlbl Firmware cxlbl.081.232; Lexmark Cxlbn Firmware cxlbn.081.232; Lexmark Cxnzj Firmware cxnzj.081.232; Lexmark Cxtat Firmware cxtat.081.233; Lexmark Cxtmm Firmware cxtmm.081.232; Lexmark Cxtpc Firmware cxtpc.081.232. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html
• https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf
• https://support.lexmark.com/alerts/
• http://packetstormsecurity.com/files/174763/Lexmark-Device-Embedded-Web-Server-Remote-Code-Execution.html
• https://publications.lexmark.com/publications/security-alerts/CVE-2023-26068.pdf
• https://support.lexmark.com/alerts/

Get alerted when CVE-2023-26068 or the next vulnerability affects your stack