CVE-2025-1127

Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server

Published Feb 13, 2025 CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Description
The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

Remediation

Vendor Solution

Lexmark recommends a firmware update if your device has affected firmware.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-2017 The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
History
Type Values Removed Values Added
Metrics epss

{'score': 0.00126}

epss

{'score': 0.00141}

Type Values Removed Values Added
Metrics epss

{'score': 0.00175}

epss

{'score': 0.00126}

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
Title Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
Weaknesses CWE-22
CWE-362
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H'}

Weaknesses

Sources

Status
PUBLISHED
Assigner
Lexmark
Published
Updated
Feb 13, 2025, 7:14 PM
Reserved
Feb 7, 2025, 9:52 PM
Status
Deferred
Published
Feb 13, 2025, 7:15 PM
Modified
Jun 17, 2026, 8:38 AM