by Kastro
Paper/Archive/CVE-2025-1127

CVE-2025-1127

Lexmark CX, XC, CS, MS, MX, XM, et. al. — Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

EPSS 0.5%CVSS 9.1
critical.is priorityof 100
36
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 45.6.456 × 209.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

Affected

ProductAffectedFixed inSource
CX, XC, CS, MS, MX, XM, et. al.≤ CXTLS.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ MXTLS.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CSTLS.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ MSNSN.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ MSTSN.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ MXTSN.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CSNGV.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CSTGV.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CXTGV.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CXTPC.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ CSTPC.240.205–CNA
CX, XC, CS, MS, MX, XM, et. al.≤ MXTCT.240.205–CNA

Scores by source

Lexmark (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

reflexmark.com/en_us/solutions/security/lexmark-security-advisories.html