How to remediate – Lexmark Markvision Enterprise Default Credentials

1. Introduction

The Lexmark Markvision Enterprise Default Credentials vulnerability allows unauthorised access to a web-based printer and multi-function device management system due to the use of known default credentials for admin level access. This poses a risk to the confidentiality, integrity, and availability of managed printers and associated data. Systems affected are typically Lexmark Markvision Enterprise installations. A successful exploit could allow an attacker full control over the printer management system.

2. Technical Explanation

• Root cause: Use of weak or hardcoded default credentials.
• Exploit mechanism: An attacker attempts to log into the Markvision Enterprise web interface using common default credentials (e.g., admin/admin).
• Scope: Lexmark Markvision Enterprise installations, specifically the web-based management system.

3. Detection and Assessment

Confirming vulnerability involves checking if the default credentials still work. A quick check is to attempt a login with common defaults. A thorough method would involve reviewing configuration files for hardcoded passwords or weak credential policies.

• Quick checks: Attempt to log in to the Markvision Enterprise web interface using username ‘admin’ and password ‘admin’.
• Scanning: Nessus vulnerability ID 985d438d can detect this issue. This is an example only, other scanners may also identify it.
• Logs and evidence: Check application logs for successful logins with default credentials. The exact log path will vary depending on the installation configuration.

# No command available as this requires interactive login attempt.

4. Solution / Remediation Steps

4.1 Preparation

• Backups are not required, but taking a snapshot of the virtual machine (if applicable) is recommended. No services need to be stopped.
• Change windows are not typically required for this task but should be considered based on your organisation’s policies. Approval may be needed by IT security team.

4.2 Implementation

1. Step 1: Log in to the Markvision Enterprise web interface using the default credentials (admin/admin).
2. Step 2: Navigate to the ‘Administration’ or ‘Security’ section of the web interface. The exact location may vary depending on the version.
3. Step 3: Locate the option to change the admin user password.
4. Step 4: Enter a strong, unique password and confirm it.
5. Step 5: Save the changes.

4.3 Config or Code Example

Before

# No configuration file example available as password is changed via web interface. Default username: admin, default password: admin

After

# Password has been changed to a strong unique value. Username remains 'admin'. 

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this type of issue. Least privilege reduces the impact if an account is compromised. Safe defaults ensure systems are not exposed with weak credentials out-of-the-box. A strong password policy enforces complexity and regular changes.

• Practice 1: Implement least privilege principles to limit access rights for all users, including administrators.
• Practice 2: Enforce a strong password policy that requires complex passwords and regular rotation.

4.5 Automation (Optional)

Automation is not typically suitable for this vulnerability due to the web interface-based nature of the change.

# No automation script available.

5. Verification / Validation

• Post-fix check: Attempt to log in to the Markvision Enterprise web interface using username ‘admin’ and the *old* password. The login should fail.
• Re-test: Repeat step 1 from section 3 (attempting to log in with default credentials) – it should now fail.

# No command available as this requires interactive login attempt.

6. Preventive Measures and Monitoring

Update security baselines to include a requirement for strong passwords on all systems. Implement CI/CD pipeline checks to identify default credentials in configuration files. Establish a regular patch or config review cycle to ensure systems remain secure.

• Pipelines: Add static analysis tools (SAST) to your CI/CD pipeline to scan for hardcoded credentials in configuration files.
• Asset and patch process: Implement a regular review cycle (e.g., monthly or quarterly) to verify that default passwords have been changed on all systems.

7. Risks, Side Effects, and Roll Back

A risk is forgetting the new password. A side effect could be temporary service disruption if the wrong password is entered repeatedly, potentially leading to account lockout. To roll back, attempt to reset the password through any available recovery mechanisms or restore from a recent backup/snapshot.

• Risk or side effect 1: Forgetting the new password – document it securely and consider using a password manager.
• Risk or side effect 2: Account lockout due to repeated failed login attempts – allow sufficient time for users to enter the correct credentials.
• Roll back: If possible, reset the admin user’s password through any available recovery options within the Markvision Enterprise interface. Otherwise, restore from a recent backup/snapshot.

8. References and Resources

• Vendor advisory or bulletin: http://www.nessus.org/u?985d438d