Vulnerability · Published Oct 27, 2023 · Assigned by lenovo
CVE-2022-34886
High 8.8
In plain English
A high-severity buffer overflow in Printer G263DNS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.1%top 34.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Printer GM265DN (production date June 2022 and before) | – before 01.00.20N |
| Lenovo | Printer GM265DN (production date July 2022 and later) | – before 01.17.00.03.00 |
| Lenovo | Printer GM266DNS | – before 02.06.00.04.00 |
| Lenovo | Printer G263DNS | – before 02.06.00.04.00 |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H