Riskcovery

CVE-2025-1127

Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

State
Published
Severity
9.1 Critical
Published
Feb 13, 2025
Updated
Feb 13, 2025
Reserved
Feb 7, 2025

Read the record on cve.org

Description

The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HLexmark

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

ProductVersions
CX, XC, CS, MS, MX, XM, et. al.Lexmark
  • CXTLS.240.205 and earlierAffectedfrom CXTLS.240.206 and laterNot affected
  • MXTLS.240.205 and earlierAffectedfrom MXTLS.240.206 and laterNot affected
  • CSTLS.240.205 and earlierAffectedfrom CSTLS.240.206 and laterNot affected
  • MSNSN.240.205 and earlierAffectedfrom MSNSN.240.206 and laterNot affected
  • MSTSN.240.205 and earlierAffectedfrom MSTSN.240.206 and laterNot affected
  • MXTSN.240.205 and earlierAffectedfrom MXTSN.240.206 and laterNot affected
  • CSNGV.240.205 and earlierAffectedfrom CSNGV.240.206 and laterNot affected
  • CSTGV.240.205 and earlierAffectedfrom CSTGV.240.206 and laterNot affected
  • CXTGV.240.205 and earlierAffectedfrom CXTGV.240.206 and laterNot affected
  • CXTPC.240.205 and earlierAffectedfrom CXTPC.240.206 and laterNot affected
  • CSTPC.240.205 and earlierAffectedfrom CSTPC.240.206 and laterNot affected
  • MXTCT.240.205 and earlierAffectedfrom MXTCT.240.206 and laterNot affected
  • MXTPM.240.205 and earlierAffectedfrom MXTPM.240.206 and laterNot affected
  • CXTMM.240.205 and earlierAffectedfrom CXTMM.240.206 and laterNot affected
  • CSTMM.240.205 and earlierAffectedfrom CSTMM.240.206 and laterNot affected
  • MSNGM.240.205 and earlierAffectedfrom MSNGM.240.206 and laterNot affected
  • MSTGM.240.205 and earlierAffectedfrom MSTGM.240.206 and laterNot affected
  • MXNGM.240.205 and earlierAffectedfrom MXNGM.240.206 and laterNot affected
  • MXTGM.240.205 and earlierAffectedfrom MXTGM.240.206 and laterNot affected
  • MSNGW.240.205 and earlierAffectedfrom MSNGW.240.206 and laterNot affected
  • MSTGW.240.205 and earlierAffectedfrom MSTGW.240.206 and laterNot affected
  • MXTGW.240.205 and earlierAffectedfrom MXTGW.240.206 and laterNot affected
  • CSTZJ.240.205 and earlierAffectedfrom CSTZJ.240.206 and laterNot affected
  • CSNZJ.240.205 and earlierAffectedfrom CSNZJ.240.206 and laterNot affected
  • CXTZJ.240.205 and earlierAffectedfrom CXTZJ.240.206 and laterNot affected
  • and 15 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.