Critical severity · published Jan 27, 2016
CVE-2016-1896
Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows…
9.8
CVSS
3.3%
EPSS
No
On KEV
Description
Race condition in the initialization process on Lexmark printers with firmware ATL before ATL.02.049, CB before CB.02.049, PP before PP.02.049, and YK before YK.02.049 allows remote attackers to bypass authentication by leveraging incorrect detection of the security-jumper status.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PF
Printer Firmware · Lexmark
through cb.02.048; through atl.02.048; through yk.02.048; through pp.02.048 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-1896
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-1896
Vendor Advisory
http://support.lexmark.com/index?page=content&id=TE745
More from Printer Firmware
4.6
CVE-2016-3145
Lexmark printers with firmware ATL before ATL.021.063, CB before CB.021.063, PP before PP.021.063, and YK before YK.021.063 mishandle Erase Printer Memory and Erase Hard Disk…