« Volver al listado

CVE-2021-35449

Estado: ModificadaAlta (7.8)—

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Lexmark — G2 DriverLexmark — G3 DriverLexmark — G4 DriverLexmark — Universal Print Driver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-35449",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-19T15:15:07.780",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/163811/Lexmark-Driver-Privilege-Escalation.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://support.lexmark.com/alerts/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_02.txt",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/163811/Lexmark-Driver-Privilege-Escalation.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://support.lexmark.com/alerts/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_02.txt",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM."
    },
    {
      "lang": "es",
      "value": "El Lexmark Universal Print Driver versión 2.15.1.0 e inferior, driver versión G2 2.7.1.0 e inferior, G3 driver versión 3.2.0.0 e inferior y G4 driver versión 4.2.1.0 e inferior están afectados por una vulnerabilidad de escalada de privilegios. Un usuario estándar poco privilegiado puede usar el controlador para ejecutar una DLL de su elección durante el proceso de adición de la impresora, resultando en una escalada de privilegios a SYSTEM"
    }
  ],
  "lastModified": "2026-06-17T03:57:30.697",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:lexmark:g2_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3CD526E8-73A3-4D76-9658-A323DC6920F6",
              "versionEndIncluding": "2.7.1.0"
            },
            {
              "criteria": "cpe:2.3:a:lexmark:g3_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4ED1BEA9-FF02-47B2-A8BE-AD01098849C5",
              "versionEndIncluding": "3.2.0.0"
            },
            {
              "criteria": "cpe:2.3:a:lexmark:g4_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "724C5598-AC84-46EA-A972-6F4BA850D154",
              "versionEndIncluding": "4.2.1.0"
            },
            {
              "criteria": "cpe:2.3:a:lexmark:universal_print_driver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C7C6DB5-C1A8-417D-8E21-501F4FD26254",
              "versionEndIncluding": "2.15.1.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}