CVE-2019-19772

published 2020-03-06

CVE-2019-19772: Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in…

Priority P4 24 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

Various Lexmark products have reflected XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&locale=en&userlocale=EN_US.

Affected

80 ranges · showing 25

Vendor	Product	Version range	Fixed in
lexmark	6500e_firmware	<= lhs60.jr.p735	—
lexmark	c734_firmware	<= lr.sk.p822	—
lexmark	c736_firmware	<= lr.ske.p822	—
lexmark	c746_firmware	<= lhs60.cm2.p731	—
lexmark	c748_firmware	<= lhs60.cm4.p735	—
lexmark	c792_firmware	<= lhs60.hc.p735	—
lexmark	c925_firmware	<= lhs60.hv.p735	—
lexmark	c950_firmware	<= lhs60.tp.p735	—
lexmark	cs31x_firmware	<= lw74.vyl.p267	—
lexmark	cs41x_firmware	<= lw74.vy2.p267	—
lexmark	cs51x_firmware	<= lw74.vy4.p267	—
lexmark	cs748_firmware	<= lhs60.cm4.p735	—
lexmark	cs796_firmware	<= lhs60.hc.p735	—
lexmark	cx310_firmware	<= lw74.gm2.p267	—
lexmark	cx410_firmware	<= lw74.gm4.p267	—
lexmark	cx510_firmware	<= lw74.gm7.p267	—
lexmark	e46x_firmware	<= lr.lbh.p822	—
lexmark	m1140_firmware	<= lw74.prl.p267	—
lexmark	m1145_firmware	<= lw74.pr2.p267	—
lexmark	m3150_firmware	<= lw74.pr4.p267	—
lexmark	m3150dn_firmware	<= lw74.pr2.p267	—
lexmark	m5155_firmware	<= lw74.dn4.p267	—
lexmark	m5163_firmware	<= lw74.dn4.p267	—
lexmark	m5163dn_firmware	<= lw74.dn2.p267	—
lexmark	m5170_firmware	<= lw74.dn7.p267	—

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

nvd v2.0 3.5 LOW AV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79