CVE-2025-65078

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-65078", "assignerOrgId": "7bc73191-a2b6-4c63-9918-753964601853", "state": "PUBLISHED", "assignerShortName": "Lexmark", "dateReserved": "2025-11-17T13:56:38.588Z", "datePublished": "2026-02-03T20:51:20.556Z", "dateUpdated": "2026-02-26T15:04:23.262Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ", "vendor": "Lexmark", "versions": [{"lessThan": "250.210", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG", "vendor": "Lexmark", "versions": [{"lessThan": "230.507", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code."}], "value": "An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code."}], "exploits": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory.\n\n<br>"}], "value": "Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory."}], "impacts": [{"capecId": "CAPEC-38", "descriptions": [{"lang": "en", "value": "CAPEC-38 Leveraging/Manipulating Configuration File Search Paths"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 9.3, "baseSeverity": "CRITICAL", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7bc73191-a2b6-4c63-9918-753964601853", "shortName": "Lexmark", "dateUpdated": "2026-02-03T20:51:20.556Z"}, "references": [{"url": "https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html"}], "source": {"discovery": "UNKNOWN"}, "title": "Untrusted search path vulnerability in Embedded Solutions Framework", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Lexmark recommends a firmware update if your device has affected firmware.\n\n<br>"}], "value": "Lexmark recommends a firmware update if your device has affected firmware."}], "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T04:55:26.714128Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T15:04:23.262Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-65078", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-06T04:55:26.714128Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-03T21:21:04.735Z"}}], "cna": {"title": "Untrusted search path vulnerability in Embedded Solutions Framework", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-38", "descriptions": [{"lang": "en", "value": "CAPEC-38 Leveraging/Manipulating Configuration File Search Paths"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Lexmark", "product": "MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ", "versions": [{"status": "affected", "version": "0", "lessThan": "250.210", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Lexmark", "product": "CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG", "versions": [{"status": "affected", "version": "0", "lessThan": "230.507", "versionType": "custom"}], "defaultStatus": "unaffected"}], "exploits": [{"lang": "en", "value": "Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory.", "supportingMedia": [{"type": "text/html", "value": "Lexmark is not aware of any malicious use against Lexmark products of the vulnerability described in this advisory.\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html"}], "workarounds": [{"lang": "en", "value": "Lexmark recommends a firmware update if your device has affected firmware.", "supportingMedia": [{"type": "text/html", "value": "Lexmark recommends a firmware update if your device has affected firmware.\n\n<br>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.", "supportingMedia": [{"type": "text/html", "value": "An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426 Untrusted Search Path"}]}], "providerMetadata": {"orgId": "7bc73191-a2b6-4c63-9918-753964601853", "shortName": "Lexmark", "dateUpdated": "2026-02-03T20:51:20.556Z"}}}, "cveMetadata": {"cveId": "CVE-2025-65078", "state": "PUBLISHED", "dateUpdated": "2026-02-26T15:04:23.262Z", "dateReserved": "2025-11-17T13:56:38.588Z", "assignerOrgId": "7bc73191-a2b6-4c63-9918-753964601853", "datePublished": "2026-02-03T20:51:20.556Z", "assignerShortName": "Lexmark"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MXTCT, MSNGM, MSTGM, MXNGM, MXTGM, CSNGV, CSTGV, CXTGV, MSNGW, MSTGW, MXTGW, CSTLS, CXTLS, MXTLS, CSTMM, CXTMM, CSTPC, CXTPC, MXTPM, MSNSN, MSTSN, MXTSN, CSNZJ, CSTZJ, CXNZJ, CXTZJ", "vendor": "Lexmark", "versions": [{"lessThan": "250.210", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "CSTAT, CXTAT, MSLBD, MXLBD, CSLBL, CXLBL, CSLBN, CXLBN, CSTMH, CXTMH, CSTPP, CXTPP, MSLSG, MXLSG", "vendor": "Lexmark", "versions": [{"lessThan": "230.507", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "7bc73191-a2b6-4c63-9918-753964601853"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad de ruta de b\u00fasqueda no confiable en el framework de Soluciones Integradas en varios dispositivos Lexmark. Esta vulnerabilidad puede ser aprovechada por un atacante para ejecutar c\u00f3digo arbitrario."}], "id": "CVE-2025-65078", "lastModified": "2026-06-17T09:55:24.317", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "7bc73191-a2b6-4c63-9918-753964601853", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65078", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T04:55:26.714128Z", "version": "2.0.3"}}]}, "published": "2026-02-03T21:16:11.280", "references": [{"source": "7bc73191-a2b6-4c63-9918-753964601853", "url": "https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html"}], "sourceIdentifier": "7bc73191-a2b6-4c63-9918-753964601853", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}], "source": "7bc73191-a2b6-4c63-9918-753964601853", "type": "Secondary"}]}

{}

{"created": "2026-02-04T12:05:47.143989+00:00", "updated": "2026-02-04T12:05:47.144023+00:00", "vendors": ["lexmark", "lexmark$PRODUCT$cslbl", "lexmark$PRODUCT$cslbn", "lexmark$PRODUCT$csngv", "lexmark$PRODUCT$csnzj", "lexmark$PRODUCT$cstat", "lexmark$PRODUCT$cstgv", "lexmark$PRODUCT$cstls", "lexmark$PRODUCT$cstmh", "lexmark$PRODUCT$cstmm", "lexmark$PRODUCT$cstpc", "lexmark$PRODUCT$cstpp", "lexmark$PRODUCT$cstzj", "lexmark$PRODUCT$cxlbl", "lexmark$PRODUCT$cxlbn", "lexmark$PRODUCT$cxnzj", "lexmark$PRODUCT$cxtat", "lexmark$PRODUCT$cxtgv", "lexmark$PRODUCT$cxtls", "lexmark$PRODUCT$cxtmh", "lexmark$PRODUCT$cxtmm", "lexmark$PRODUCT$cxtpc", "lexmark$PRODUCT$cxtpp", "lexmark$PRODUCT$cxtzj", "lexmark$PRODUCT$mslbd", "lexmark$PRODUCT$mslsg", "lexmark$PRODUCT$msngm", "lexmark$PRODUCT$msngw", "lexmark$PRODUCT$msnsn", "lexmark$PRODUCT$mstgm", "lexmark$PRODUCT$mstgw", "lexmark$PRODUCT$mstsn", "lexmark$PRODUCT$mxlbd", "lexmark$PRODUCT$mxlsg", "lexmark$PRODUCT$mxngm", "lexmark$PRODUCT$mxtct", "lexmark$PRODUCT$mxtgm", "lexmark$PRODUCT$mxtgw", "lexmark$PRODUCT$mxtls", "lexmark$PRODUCT$mxtpm", "lexmark$PRODUCT$mxtsn"]}