Riskcovery

CVE-2025-9269

Server-Side Request Forgery (SSRF) vulnerability found in embedded web server

State
Published
Severity
6.9 Medium
Published
Sep 9, 2025
Updated
Sep 29, 2025
Reserved
Aug 20, 2025

Read the record on cve.org

Description

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.

Scores

CVSSScoreVectorSource
4.06.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:NLexmark

Weaknesses

  • CWE-918 Server-Side Request Forgery (SSRF)

Affected Products

ProductVersions
CX, XC, CS, MS, MX, XM, et. al.Lexmark
  • CXTLS.250.199 and earlierAffectedfrom CXTLS.250.200 and laterNot affected
  • MXTLS.250.199 and earlierAffectedfrom MXTLS.250.200 and laterNot affected
  • CSTLS.250.199 and earlierAffectedfrom CSTLS.250.200 and laterNot affected
  • MSNSN.250.199 and earlierAffectedfrom MSNSN.250.200 and laterNot affected
  • MSTSN.250.199 and earlierAffectedfrom MSTSN.250.200 and laterNot affected
  • MXTSN.250.199 and earlierAffectedfrom MXTSN.250.200 and laterNot affected
  • CSNGV.250.199 and earlierAffectedfrom CSNGV.250.200 and laterNot affected
  • CSTGV.250.199 and earlierAffectedfrom CSTGV.250.200 and laterNot affected
  • CXTGV.250.199 and earlierAffectedfrom CXTGV.250.200 and laterNot affected
  • CXTPC.250.199 and earlierAffectedfrom CXTPC.250.200 and laterNot affected
  • CSTPC.250.199 and earlierAffectedfrom CSTPC.250.200 and laterNot affected
  • MXTCT.250.199 and earlierAffectedfrom MXTCT.250.200 and laterNot affected
  • MXTPM.250.199 and earlierAffectedfrom MXTPM.250.200 and laterNot affected
  • CXTMM.250.199 and earlierAffectedfrom CXTMM.250.200 and laterNot affected
  • CSTMM.250.199 and earlierAffectedfrom CSTMM.250.200 and laterNot affected
  • MSNGM.250.199 and earlierAffectedfrom MSNGM.250.200 and laterNot affected
  • MSTGM.250.199 and earlierAffectedfrom MSTGM.250.200 and laterNot affected
  • MXNGM.250.199 and earlierAffectedfrom MXNGM.250.200 and laterNot affected
  • MXTGM.250.199 and earlierAffectedfrom MXTGM.250.200 and laterNot affected
  • MSNGW.250.199 and earlierAffectedfrom MSNGW.250.200 and laterNot affected
  • MSTGW.250.199 and earlierAffectedfrom MSTGW.250.200 and laterNot affected
  • MXTGW.250.199 and earlierAffectedfrom MXTGW.250.200 and laterNot affected
  • CSTZJ.250.199 and earlierAffectedfrom CSTZJ.250.200 and laterNot affected
  • CSNZJ.250.199 and earlierAffectedfrom CSNZJ.250.200 and laterNot affected
  • CXTZJ.250.199 and earlierAffectedfrom CXTZJ.250.200 and laterNot affected
  • and 34 more versions

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.