Threat Investigation
Request a demo

CVE-2018-18894

High

Description

Certain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.

SeverityHigh
CVSS7.5
Exploit probability—
ProductLexmark 6500e Firmware
PublishedMar 10, 2020
First seenMar 10, 2020

How to fix

Update
  • lexmark 6500e_firmwarelhs60.jr.p683 or later
  • lexmark c748_firmwarelhs60.cm4.p683 or later
  • lexmark c79x_firmwarelhs60.hc.p683 or later
  • lexmark c925_firmwarelhs60.hv.p683 or later
  • lexmark c95x_firmwarelhs60.tp.p683 or later
  • lexmark cs41x_firmwarelw71.vy2.p216 or later
  • lexmark cs51x_firmwarelw71.vy4.p216 or later
  • lexmark cs796_firmwarelhs60.hc.p683 or later
  • lexmark cx410_firmwarelw71.gm4.p216 or later
  • lexmark cx510_firmwarelw71.gm7.p216 or later
  • lexmark m3150_firmwarelw71.pr4.p216 or later
  • lexmark m5155_firmwarelw71.dn4.p216 or later

Affected products

ProductAffected versionsFixed in
lexmark 6500e_firmwarev < lhs60.jr.p683lhs60.jr.p683
lexmark c748_firmwarev < lhs60.cm4.p683lhs60.cm4.p683
lexmark c79x_firmwarev < lhs60.hc.p683lhs60.hc.p683
lexmark c925_firmwarev < lhs60.hv.p683lhs60.hv.p683
lexmark c95x_firmwarev < lhs60.tp.p683lhs60.tp.p683
lexmark cs41x_firmwarev < lw71.vy2.p216lw71.vy2.p216
lexmark cs51x_firmwarev < lw71.vy4.p216lw71.vy4.p216
lexmark cs748_firmwarev ≤ lhs60.cm4.p683—
lexmark cs796_firmwarev < lhs60.hc.p683lhs60.hc.p683
lexmark cx410_firmwarev < lw71.gm4.p216lw71.gm4.p216
lexmark cx510_firmwarev < lw71.gm7.p216lw71.gm7.p216
lexmark m3150_firmwarev < lw71.pr4.p216lw71.pr4.p216
lexmark m5155_firmwarev < lw71.dn4.p216lw71.dn4.p216
lexmark m5163_firmwarev < lw71.dn4.p216lw71.dn4.p216
lexmark m5170_firmwarev < lw71.dn7.p216lw71.dn7.p216
lexmark ms610de_firmwarev < lw71.pr4.p216lw71.pr4.p216
lexmark ms610dte_firmwarev < lw71.pr4.p216lw71.pr4.p216
lexmark ms810de_firmwarev < lw71.dn4.p216lw71.dn4.p216
lexmark ms812de_firmwarev < lw71.dn7.p216lw71.dn7.p216
lexmark ms91x_firmwarev < lw71.sa.p216lw71.sa.p216
lexmark mx410_firmwarev < lw71.sb4.p216lw71.sb4.p216
lexmark mx510_firmwarev < lw71.sb4.p216lw71.sb4.p216
lexmark mx511_firmwarev < lw71.sb4.p216lw71.sb4.p216
lexmark mx610_firmwarev < lw71.sb7.p216lw71.sb7.p216
lexmark mx611_firmwarev < lw71.sb7.p216lw71.sb7.p216
lexmark mx6500e_firmwarev ≤ lw71.jd.p216—
lexmark mx71x_firmwarev < lw71.tu.p216lw71.tu.p216
lexmark mx81x_firmwarev < lw71.tu.p216lw71.tu.p216
lexmark mx91x_firmwarev < lw71.mg.p216lw71.mg.p216
lexmark sm91x_firmwarev < lw71.mg.p216lw71.mg.p216
lexmark x46x_firmwarev < lr.bs.p810lr.bs.p810
lexmark x548_firmwarev < lhs60.vk.p683lhs60.vk.p683
lexmark x65x_firmwarev < lr.mn.p810lr.mn.p810
lexmark x73x_firmwarev < lr.fl.p810lr.fl.p810
lexmark x74x_firmwarev < lhs60.ny.p683lhs60.ny.p683
lexmark x792_firmwarev < lhs60.mr.p683lhs60.mr.p683
lexmark x86x_firmwarev < lr.sp.p810lr.sp.p810
lexmark x925_firmwarev < lhs60.hk.p683lhs60.hk.p683
lexmark x95x_firmwarev < lhs60.tq.p683lhs60.tq.p683
lexmark xc2132_firmwarev < lw71.gm7.p216lw71.gm7.p216
lexmark xm1145_firmwarev < lw71.sb4.p216lw71.sb4.p216
lexmark xm3150_firmwarev < lw71.sb7.p216lw71.sb7.p216
lexmark xm51xx_firmwarev < lw71.tu.p216lw71.tu.p216
lexmark xm71xx_firmwarev < lw71.tu.p216lw71.tu.p216
lexmark xs478_firmwarev < lhs60.ny.p683lhs60.ny.p683
lexmark xs548_firmwarev < lhs60.vk.p683lhs60.vk.p683
lexmark xs79x_firmwarev < lhs60.mr.p683lhs60.mr.p683
lexmark xs925_firmwarev < lhs60.hk.p683lhs60.hk.p683
lexmark xs95x_firmwarev < lhs60.tq.p683lhs60.tq.p683

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.