CVE-2021-35449

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing during the add printer process, resulting in escalation of privileges to SYSTEM.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/163811/Lexmark-Driver-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://support.lexmark.com/alerts/Vendor Advisory
https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_02.txtThird Party Advisory
http://packetstormsecurity.com/files/163811/Lexmark-Driver-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://support.lexmark.com/alerts/Vendor Advisory
https://raw.githubusercontent.com/jacob-baines/vuln_disclosure/main/vuln_2021_02.txtThird Party Advisory

Timeline

Published: Jul 19, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-35456.5An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and includi CVE-2021-354507.2A Server Side Template Injection in the Entando Admin Console 6.3.9 and before allows a user with privileges to execute FreeMarker template CVE-2021-354516.1In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can inject arbitrary text into user browser via the Web app CVE-2021-354526.5An Incorrect Access Control vulnerability exists in libde265 v1.0.8 due to a SEGV in slice.cc.CVE-2021-354569.8Online Pet Shop We App 1.0 is vulnerable to remote SQL injection and shell upload CVE-2021-354589.8Online Pet Shop We App 1.0 is vulnerable to Union SQL Injection in products.php (aka p=products) via the c or s parameter.CVE-2021-35468.2An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including CVE-2021-354636.1Cross-site scripting (XSS) vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 allows remote attackers to inject arbitrary w CVE-2021-354649.8ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitatio CVE-2021-354653.4Certain Arm products before 2021-08-23 do not properly consider the effect of exceptions on a VLLDM instruction. A Non-secure handler may ha CVE-2021-354697.8The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry CVE-2021-35477.4OpenVPN 3 Core Library version 3.6 and 3.6.1 allows a man-in-the-middle attacker to bypass the certificate authentication by issuing an unre