High severity · published Sep 1, 2023
CVE-2023-40239
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
C2132 Firmware · Lexmark
through lw80.vy4.p245 · source: NVD
CF
Cs310 Firmware · Lexmark
through lw80.vyl.p245 · source: NVD
CF
Cs317 Firmware · Lexmark
through lw80.vyl.p245 · source: NVD
CF
Cs410 Firmware · Lexmark
through lw80.vy2.p245 · source: NVD
CF
Cs417 Firmware · Lexmark
through lw80.vy2.p245 · source: NVD
CF
Cs510 Firmware · Lexmark
through lw80.vy4.p245 · source: NVD
CF
Cs517 Firmware · Lexmark
through lw80.vy4.p245 · source: NVD
CF
Cx310 Firmware · Lexmark
through lw80.gm2.p245 · source: NVD
CF
Cx317 Firmware · Lexmark
through lw80.gm2.p245 · source: NVD
CF
Cx410 Firmware · Lexmark
through lw80.gm4.p245 · source: NVD
CF
Cx417 Firmware · Lexmark
through lw80.gm4.p245 · source: NVD
CF
Cx510 Firmware · Lexmark
through lw80.gm7.p245 · source: NVD