CVE-2019-18791

published 2020-02-13

CVE-2019-18791: Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be…

Priority P4 25 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser.

Affected

80 ranges · showing 25

Vendor	Product	Version range	Fixed in
lexmark	6500e_firmware	<= lhs60.jr.p731	—
lexmark	c734_firmware	<= lr.sk.p822	—
lexmark	c736_firmware	<= lr.ske.p822	—
lexmark	c746_firmware	<= lhs60.cm2.p731	—
lexmark	c748_firmware	<= lhs60.cm4.p731	—
lexmark	c792_firmware	<= lhs60.hc.p731	—
lexmark	c925_firmware	<= lhs60.hv.p731	—
lexmark	c950_firmware	<= lhs60.tp.p731	—
lexmark	cs748_firmware	<= lhs60.cm4.p731	—
lexmark	cs796_firmware	<= lhs60.hc.p731	—
lexmark	cx310_firmware	<= lw73.gm2.p263	—
lexmark	cx31x_firmware	<= lw73.vyl.p263	—
lexmark	cx410_firmware	<= lw73.gm4.p263	—
lexmark	cx41x_firmware	<= lw73.vy2.p263	—
lexmark	cx510_firmware	<= lw73.gm7.p263	—
lexmark	cx51x_firmware	<= lw73.vy4.p263	—
lexmark	e46x_firmware	<= lr.lbh.p822	—
lexmark	m1140_firmware	<= lw73.prl.p263	—
lexmark	m1145_firmware	<= lw73.pr2.p263	—
lexmark	m3150_firmware	<= lw73.pr4.p263	—
lexmark	m3150dn_firmware	<= lw73.pr2.p263	—
lexmark	m5155_firmware	<= lw73.dn4.p263	—
lexmark	m5163_firmware	<= lw73.dn4.p263	—
lexmark	m5163dn_firmware	<= lw73.dn2.p263	—
lexmark	m5170_firmware	<= lw73.dn7.p263	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79