CVE-2025-1127 — Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

Description (CNA)

The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

Affected (CNA)

Vendor / product	Versions
Lexmark / CX, XC, CS, MS, MX, XM, et. al.	affected 0 through CXTLS.240.205; affected 0 through MXTLS.240.205; affected 0 through CSTLS.240.205; affected 0 through MSNSN.240.205; affected 0 through MSTSN.240.205; affected 0 through MXTSN.240.205; affected 0 through CSNGV.240.205; affected 0 through CSTGV.240.205; affected 0 through CXTGV.240.205; affected 0 through CXTPC.240.205; affected 0 through CSTPC.240.205; affected 0 through MXTCT.240.205; affected 0 through MXTPM.240.205; affected 0 through CXTMM.240.205; affected 0 through CSTMM.240.205; affected 0 through MSNGM.240.205; affected 0 through MSTGM.240.205; affected 0 through MXNGM.240.205; affected 0 through MXTGM.240.205; affected 0 through MSNGW.240.205; affected 0 through MSTGW.240.205; affected 0 through MXTGW.240.205; affected 0 through CSTZJ.240.205; affected 0 through CSNZJ.240.205; affected 0 through CXTZJ.240.205; affected 0 through CXNZJ.240.205; affected 0 through MSLSG.240.407; affected 0 through MXLSG.240.407; affected 0 through MSLBD.240.407; affected 0 through MXLBD.240.407; affected 0 through CSLBN.240.407; affected 0 through CSLBL.240.407; affected 0 through CXLBN.240.407; affected 0 through CXLBL.240.407; affected 0 through CXTPP.240.407; affected 0 through CSTPP.240.407; affected 0 through CSTAT.240.407; affected 0 through CXTAT.240.407; affected 0 through CSTMH.240.407; affected 0 through CXTMH.240.407

Vendor / product

Versions

Lexmark / CX, XC, CS, MS, MX, XM, et. al.

affected 0 through CXTLS.240.205; affected 0 through MXTLS.240.205; affected 0 through CSTLS.240.205; affected 0 through MSNSN.240.205; affected 0 through MSTSN.240.205; affected 0 through MXTSN.240.205; affected 0 through CSNGV.240.205; affected 0 through CSTGV.240.205; affected 0 through CXTGV.240.205; affected 0 through CXTPC.240.205; affected 0 through CSTPC.240.205; affected 0 through MXTCT.240.205; affected 0 through MXTPM.240.205; affected 0 through CXTMM.240.205; affected 0 through CSTMM.240.205; affected 0 through MSNGM.240.205; affected 0 through MSTGM.240.205; affected 0 through MXNGM.240.205; affected 0 through MXTGM.240.205; affected 0 through MSNGW.240.205; affected 0 through MSTGW.240.205; affected 0 through MXTGW.240.205; affected 0 through CSTZJ.240.205; affected 0 through CSNZJ.240.205; affected 0 through CXTZJ.240.205; affected 0 through CXNZJ.240.205; affected 0 through MSLSG.240.407; affected 0 through MXLSG.240.407; affected 0 through MSLBD.240.407; affected 0 through MXLBD.240.407; affected 0 through CSLBN.240.407; affected 0 through CSLBL.240.407; affected 0 through CXLBN.240.407; affected 0 through CXLBL.240.407; affected 0 through CXTPP.240.407; affected 0 through CSTPP.240.407; affected 0 through CSTAT.240.407; affected 0 through CXTAT.240.407; affected 0 through CSTMH.240.407; affected 0 through CXTMH.240.407

CWE

CWE-22, CWE-362

References

https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.