CVE-2025-9269

Summary

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.

Affected Software

VendorProductVersion RangeStatus
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTLS.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTLS.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTLS.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSNSN.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSTSN.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTSN.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSNGV.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTGV.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTGV.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTPC.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTPC.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTCT.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTPM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTMM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTMM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSNGM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSTGM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXNGM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTGM.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSNGW.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSTGW.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXTGW.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTZJ.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSNZJ.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTZJ.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXNZJ.250.199affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSLSG.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXLSG.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MSLBD.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= MXLBD.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSLBN.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSLBL.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXLBN.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXLBL.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTPP.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTPP.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTAT.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTAT.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CSTMH.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= CXTMH.230.466affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.TL2.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.PR2.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.PR4.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.SB4.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.SB7.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.DN2.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.DN4.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.DN7.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.TU.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.SA.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.MG.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.GM7.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.GM4.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW90.VY4.P224affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW80.PRL.P260affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW80.SB2.P260affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW80.VYL.P260affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW80.VY2.P260affected
LexmarkCX, XC, CS, MS, MX, XM, et. al.0 <= LW80.GM2.P260affected

Weaknesses

  • CWE-918: CWE-918: Server-Side Request Forgery (SSRF)

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References