Home

Description

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.

PUBLISHED Reserved 2025-08-20 | Published 2025-09-09 | Updated 2025-09-29 | Assigner Lexmark




MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Problem types

CWE-918: Server-Side Request Forgery (SSRF)

Product status

Default status
unaffected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

Any version
affected

References

www.lexmark.com/...security/lexmark-security-advisories.html

cve.org (CVE-2025-9269)

nvd.nist.gov (CVE-2025-9269)

Download JSON