Security readout for executives and security teams
Plain-English summary
CVE-2020-35546 is an incorrect access control issue reported for Lexmark MX6500 devices running LW75.JD.P296 and previous firmware. In business terms, a vulnerable printer could allow unauthorized access to protected settings or information. The CVSS score is critical, but the supplied sources do not show active exploitation.
Executive priority
Treat this as high-priority asset hygiene for enterprise printers. Critical CVSS and unauthenticated network reachability justify prompt inventory, exposure reduction, and vendor-guidance review, even without confirmed active exploitation.
Technical view
The record maps to CWE-284 and carries CVSS 3.1 score 9.1: network-accessible, low-complexity, no privileges, no user interaction, unchanged scope, high confidentiality and integrity impact, and no availability impact. The structured affected-product fields are incomplete, so exposure should be verified against Lexmark advisory details.
Likely exposure
Organizations with Lexmark MX6500 devices running LW75.JD.P296 or earlier are the likely exposure group. Risk is highest where printer administration or access-control interfaces are reachable from untrusted networks.
Exploitation context
The supplied bundle does not cite public exploitation, and KEV is false. The CVSS vector indicates the flaw may be remotely reachable without authentication, so externally exposed or broadly reachable printers deserve prompt review.
Researcher notes
Evidence is limited to the CVE metadata and Lexmark advisory reference. The affected fields in the CVE bundle are marked n/a, so researchers should rely on the vendor PDF for exact product and firmware applicability before drawing conclusions.
Mitigation direction
- Review the Lexmark advisory for confirmed affected firmware and vendor remediation guidance.
- Inventory Lexmark MX6500 devices and record firmware versions.
- Restrict printer management access to trusted administrative networks or VPN.
- Audit and harden access control settings on affected devices.
- Monitor printer logs and network telemetry for unusual administrative access.
Validation and detection
- Confirm whether any Lexmark MX6500 devices are deployed.
- Compare device firmware against LW75.JD.P296 and previous versions.
- Verify printer administration interfaces are not internet-exposed.
- Review configured access controls for unintended anonymous or broad access.
- Document remediation status for each affected asset.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2020-35546 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N3.95.2CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
9.1CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://publications.lexmark.com/publications/security-alerts/CVE-2020-35546.pdfCVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.