7.5

CVE-2018-18894

Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lexmark ≫ 6500e Firmware Version < lhs60.jr.p683
   Lexmark ≫ 6500e Version-
Lexmark ≫ C748 Firmware Version < lhs60.cm4.p683
   Lexmark ≫ C748 Version-
Lexmark ≫ C79x Firmware Version < lhs60.hc.p683
   Lexmark ≫ C79x Version-
Lexmark ≫ C925 Firmware Version < lhs60.hv.p683
   Lexmark ≫ C925 Version-
Lexmark ≫ C95x Firmware Version < lhs60.tp.p683
   Lexmark ≫ C95x Version-
Lexmark ≫ Cs41x Firmware Version < lw71.vy2.p216
   Lexmark ≫ Cs41x Version-
Lexmark ≫ Cs51x Firmware Version < lw71.vy4.p216
   Lexmark ≫ Cs51x Version-
Lexmark ≫ Cs748 Firmware Version <= lhs60.cm4.p683
   Lexmark ≫ Cs748 Version-
Lexmark ≫ Cs796 Firmware Version < lhs60.hc.p683
   Lexmark ≫ Cs796 Version-
Lexmark ≫ Cx410 Firmware Version < lw71.gm4.p216
   Lexmark ≫ Cx410 Version-
Lexmark ≫ Cx510 Firmware Version < lw71.gm7.p216
   Lexmark ≫ Cx510 Version-
Lexmark ≫ M3150 Firmware Version < lw71.pr4.p216
   Lexmark ≫ M3150 Version-
Lexmark ≫ M5155 Firmware Version < lw71.dn4.p216
   Lexmark ≫ M5155 Version-
Lexmark ≫ M5163 Firmware Version < lw71.dn4.p216
   Lexmark ≫ M5163 Version-
Lexmark ≫ M5170 Firmware Version < lw71.dn7.p216
   Lexmark ≫ M5170 Version-
Lexmark ≫ Ms610de Firmware Version < lw71.pr4.p216
   Lexmark ≫ Ms610de Version-
Lexmark ≫ Ms610dte Firmware Version < lw71.pr4.p216
   Lexmark ≫ Ms610dte Version-
Lexmark ≫ Ms810de Firmware Version < lw71.dn4.p216
   Lexmark ≫ Ms810de Version-
Lexmark ≫ Ms812de Firmware Version < lw71.dn7.p216
   Lexmark ≫ Ms812de Version-
Lexmark ≫ Ms91x Firmware Version < lw71.sa.p216
   Lexmark ≫ Ms91x Version-
Lexmark ≫ Mx410 Firmware Version < lw71.sb4.p216
   Lexmark ≫ Mx410 Version-
Lexmark ≫ Mx510 Firmware Version < lw71.sb4.p216
   Lexmark ≫ Mx510 Version-
Lexmark ≫ Mx511 Firmware Version < lw71.sb4.p216
   Lexmark ≫ Mx511 Version-
Lexmark ≫ Mx610 Firmware Version < lw71.sb7.p216
   Lexmark ≫ Mx610 Version-
Lexmark ≫ Mx611 Firmware Version < lw71.sb7.p216
   Lexmark ≫ Mx611 Version-
Lexmark ≫ Mx6500e Firmware Version <= lw71.jd.p216
   Lexmark ≫ Mx6500e Version-
Lexmark ≫ Mx71x Firmware Version < lw71.tu.p216
   Lexmark ≫ Mx71x Version-
Lexmark ≫ Mx81x Firmware Version < lw71.tu.p216
   Lexmark ≫ Mx81x Version-
Lexmark ≫ Mx91x Firmware Version < lw71.mg.p216
   Lexmark ≫ Mx91x Version-
Lexmark ≫ Sm91x Firmware Version < lw71.mg.p216
   Lexmark ≫ Sm91x Version-
Lexmark ≫ X46x Firmware Version < lr.bs.p810
   Lexmark ≫ X46x Version-
Lexmark ≫ X548 Firmware Version < lhs60.vk.p683
   Lexmark ≫ X548 Version-
Lexmark ≫ X65x Firmware Version < lr.mn.p810
   Lexmark ≫ X65x Version-
Lexmark ≫ X73x Firmware Version < lr.fl.p810
   Lexmark ≫ X73x Version-
Lexmark ≫ X74x Firmware Version < lhs60.ny.p683
   Lexmark ≫ X74x Version-
Lexmark ≫ X792 Firmware Version < lhs60.mr.p683
   Lexmark ≫ X792 Version-
Lexmark ≫ X86x Firmware Version < lr.sp.p810
   Lexmark ≫ X86x Version-
Lexmark ≫ X925 Firmware Version < lhs60.hk.p683
   Lexmark ≫ X925 Version-
Lexmark ≫ X95x Firmware Version < lhs60.tq.p683
   Lexmark ≫ X95x Version-
Lexmark ≫ Xc2132 Firmware Version < lw71.gm7.p216
   Lexmark ≫ Xc2132 Version-
Lexmark ≫ Xm1145 Firmware Version < lw71.sb4.p216
   Lexmark ≫ Xm1145 Version-
Lexmark ≫ Xm3150 Firmware Version < lw71.sb7.p216
   Lexmark ≫ Xm3150 Version-
Lexmark ≫ Xm51xx Firmware Version < lw71.tu.p216
   Lexmark ≫ Xm51xx Version-
Lexmark ≫ Xm71xx Firmware Version < lw71.tu.p216
   Lexmark ≫ Xm71xx Version-
Lexmark ≫ Xs478 Firmware Version < lhs60.ny.p683
   Lexmark ≫ Xs478 Version-
Lexmark ≫ Xs548 Firmware Version < lhs60.vk.p683
   Lexmark ≫ Xs548 Version-
Lexmark ≫ Xs79x Firmware Version < lhs60.mr.p683
   Lexmark ≫ Xs79x Version-
Lexmark ≫ Xs925 Firmware Version < lhs60.hk.p683
   Lexmark ≫ Xs925 Version-
Lexmark ≫ Xs95x Firmware Version < lhs60.tq.p683
   Lexmark ≫ Xs95x Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.475
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.