CVE-2018-17944

Published: Mar 12, 2019Modified: Nov 21, 2024

4.9

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.

Affected (8)

Products: Lexmark: Cx725h Firmware, Cx820 Firmware, Cx825 Firmware, Cx860 Firmware, Xc4150 Firmware, Xc6152 Firmware, Xc8155 Firmware, Xc8160 Firmware

8 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Cx725h Firmware	All versions

Running on/with	Platform Versions
Lexmark Cx725h	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Cx820 Firmware	All versions

Running on/with	Platform Versions
Lexmark Cx820	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Cx825 Firmware	All versions

Running on/with	Platform Versions
Lexmark Cx825	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Cx860 Firmware	All versions

Running on/with	Platform Versions
Lexmark Cx860	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Xc4150 Firmware	All versions

Running on/with	Platform Versions
Lexmark Xc4150	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Xc6152 Firmware	All versions

Running on/with	Platform Versions
Lexmark Xc6152	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Xc8155 Firmware	All versions

Running on/with	Platform Versions
Lexmark Xc8155	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Lexmark Xc8160 Firmware	All versions

Running on/with	Platform Versions
Lexmark Xc8160	All versions

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

http://support.lexmark.com/index?page=content&id=TE909

Source: cve@mitre.org

Vendor Advisory

http://support.lexmark.com/index?page=content&id=TE909

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.