high7.5
CVE-2023-40239
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure.
Impact
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lexmark | C2132 Firmware | through lw80.vy4.p245 |
| Lexmark | Cs310 Firmware | through lw80.vyl.p245 |
| Lexmark | Cs317 Firmware | through lw80.vyl.p245 |
| Lexmark | Cs410 Firmware | through lw80.vy2.p245 |
| Lexmark | Cs417 Firmware | through lw80.vy2.p245 |
| Lexmark | Cs510 Firmware | through lw80.vy4.p245 |
| Lexmark | Cs517 Firmware | through lw80.vy4.p245 |
| Lexmark | Cx310 Firmware | through lw80.gm2.p245 |
| Lexmark | Cx317 Firmware | through lw80.gm2.p245 |
| Lexmark | Cx410 Firmware | through lw80.gm4.p245 |
| Lexmark | Cx417 Firmware | through lw80.gm4.p245 |
| Lexmark | Cx510 Firmware | through lw80.gm7.p245 |