Vulnerability · Published Oct 27, 2023 · Assigned by lenovo
CVE-2022-34887
Medium 4.3
In plain English
A medium-severity improper authentication in Printer G263DNS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the administrator password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Printer GM265DN (production date June 2022 and before) | – before 01.00.20N |
| Lenovo | Printer GM265DN (production date July 2022 and later) | – before 01.17.00.03.00 |
| Lenovo | Printer GM266DNS | – before 02.06.00.04.00 |
| Lenovo | Printer G263DNS | – before 02.06.00.04.00 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N