Medium severity · published Mar 12, 2019
CVE-2018-17944
On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one…
4.9
CVSS
0.9%
EPSS
No
On KEV
Description
On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Cx725h Firmware · Lexmark
All versions, or not specified · source: NVD
CF
Cx820 Firmware · Lexmark
All versions, or not specified · source: NVD
CF
Cx825 Firmware · Lexmark
All versions, or not specified · source: NVD
CF
Cx860 Firmware · Lexmark
All versions, or not specified · source: NVD
XF
Xc4150 Firmware · Lexmark
All versions, or not specified · source: NVD
XF
Xc6152 Firmware · Lexmark
All versions, or not specified · source: NVD
XF
Xc8155 Firmware · Lexmark
All versions, or not specified · source: NVD
XF
Xc8160 Firmware · Lexmark
All versions, or not specified · source: NVD