CVE-2024-11344

A type confusion vulnerability (CVE-2024-11344) has been identified in the Postscript interpreter of various Lexmark devices. This bug arises from improper handling of data types within the interpreter, which can be triggered by specially crafted Postscript code.

Exploitation may be achieved by an attacker who sends a malicious Postscript file to the device, either via network printing or direct file submission. No prior authentication is required if the device exposes the interpreter to unauthenticated users, making the attack surface significant for exposed systems.

The impact is potentially severe, as successful exploitation allows an attacker to execute arbitrary code within the context of the Postscript interpreter. This could lead to full compromise of the device, including access to sensitive data or further lateral movement in a network.

Lexmark has released firmware updates to address this vulnerability. Users are advised to consult Lexmark's security advisories [1] for detailed fix information and apply the latest firmware to affected devices.