Medium severity · published Sep 9, 2025
CVE-2025-9269
Server-Side Request Forgery (SSRF) vulnerability found in embedded web server
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
CX, XC, CS, MS, MX, XM, et. al. · Lexmark
through CXTLS.250.199; through MXTLS.250.199; through CSTLS.250.199; through MSNSN.250.199; through MSTSN.250.199; through MXTSN.250.199; +34 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-9269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-9269
www.lexmark.com
https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html
More from CX, XC, CS, MS, MX, XM, et. al.
9.1
CVE-2025-1127
Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
7.3
CVE-2024-11344
Type confusion vulnerability in the Postscript interpreter in various Lexmark devices