Security researchers from DEVCORE discovered the vulnerability through Trend Micro’s Zero Day Initiative (ZDI), marking the third major printer firmware flaw disclosed in 2025 following similar incidents affecting HP and Canon devices.
Critical security vulnerability affecting over 150 Lexmark printer and multifunction device models enables remote attackers to execute malicious code on unpatched systems through a combination of path traversal and concurrent execution flaws.
Rated 9.1 on the CVSSv3 severity scale, this chained exploit (CVE-2025-1127) impacts enterprise-grade devices across Lexmark’s CX, MX, XC, and CS series, requiring immediate firmware updates to prevent network compromise.
The vulnerability stems from improper path validation in the embedded web server combined with race condition vulnerabilities in firmware processes.
Attackers can exploit these weaknesses by sending specially crafted HTTP requests that bypass directory restrictions while triggering concurrency-related memory corruption.
This allows execution of arbitrary commands with system-level privileges, potentially enabling attackers to deploy ransomware, exfiltrate printed documents, or use compromised printers as network entry points.
Lexmark’s advisory notes the attack vector requires network access and valid credentials (PR:H), but millions of devices remain vulnerable due to default admin credentials never being changed during deployment.
The high 9.1 CVSS score reflects the attack’s network-based vector (AV:N), low attack complexity (AC:L), and potential for full system compromise (C:H/I:H/A:H).
Security analysts warn this could enable lateral movement in corporate networks, particularly in healthcare and financial sectors where Lexmark devices frequently handle sensitive documents.
The vulnerability impacts Lexmark devices running firmware versions released before February 13, 2025, including high-volume models like the CX950/CX951 enterprise printers, MX953 production presses, and XC9645 multifunction devices.
Lexmark has released patched firmware versions with “.206” or “.408” suffixes across 38 distinct product families, with update procedures varying by model series.
Administrators can verify firmware versions through the control panel’s Settings→Reports→Menu Setting Page path. Notable vulnerable series include:
Lexmark’s advisory contains a 2,300-word table detailing all impacted models and corresponding fixed firmware versions, representing one of the broadest printer security alerts since the 2021 PrintNightmare crisis.
While setting administrative passwords provides partial protection, Lexmark strongly recommends installing firmware updates from their support portal.
The company has established temporary download mirrors to handle anticipated demand, with average update sizes ranging from 300MB-1.2GB depending on model capabilities.
Network administrators should:
ZDI researchers confirmed the vulnerability was responsibly disclosed through coordinated channels, with no active exploits observed as of May 2025.
However, the public release of technical details increases likelihood of weaponization within 45-60 days, according to cybersecurity firm CrowdStrike’s vulnerability lifecycle models.
Lexmark continues working with CERT/CC to monitor potential exploitation attempts across critical infrastructure sectors.
This incident highlights growing concerns about printer firmware security, following NIST’s 2024 warning that 68% of enterprise printers contain unpatched vulnerabilities.
Organizations using affected Lexmark devices should prioritize updates before June 2025, when security teams anticipate increased attack activity.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…