CVE-2022-34886

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120CWE-787

Affected software

VendorProductVersions
LenovoPrinter GM265DN (production date June 2022 and before)< 01.00.20N
LenovoPrinter GM265DN (production date July 2022 and later)< 01.17.00.03.00
LenovoPrinter GM266DNS< 02.06.00.04.00
LenovoPrinter G263DNS< 02.06.00.04.00
lenovogm265dn_firmware< 01.00.20N; < 01.17.00.03.00
lenovogm266dns_firmware< 02.06.00.04.00
lenovog263dns_firmware< 02.06.00.04.00

References

Timeline

Published
Oct 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-348875.4Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenCVE-2022-348884.3The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normaCVE-2022-348898.2This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker CVE-2022-34895.3The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settinCVE-2022-348908.8This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). ACVE-2022-348917.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. AnCVE-2022-348927.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. AnCVE-2022-348937.8Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoinCVE-2022-348945.3In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted servicesCVE-2022-348997.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacCVE-2022-34907.2The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settingsCVE-2022-349007.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attac
CVE-2022-34886: High severity, CVSS 8.8 | Vulnix