What is the CVSS score of CVE-2020-10094?

CVE-2020-10094 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.7%.

M1145 Firmware CVE-2020-10094

MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2020-04-28 cve@mitre.org

XSS M1145 Firmware Cx310 Firmware Cx410 Firmware Cx510 Firmware Xc2132 Firmware Mx31X Firmware Mx410 Firmware Mx510 Firmware Mx511 Firmware Xm1145 Firmware Mx610 Firmware Mx611 Firmware Xm3150 Firmware Mx71X Firmware Mx81X Firmware Mx91X Firmware Xm91X Firmware Mx6500E Firmware X548 Firmware Xs548 Firmware X74X Firmware Xs748 Firmware X792 Firmware Xs79X Firmware X925 Firmware Xs925 Firmware X95X Firmware Xs95X Firmware 6500E Firmware X46X Firmware X65X Firmware X73X Firmware X86X Firmware Xm51Xx Firmware Xm71Xx Firmware Cs31X Firmware Cs41X Firmware Ms310 Firmware Ms312 Firmware Ms317 Firmware Ms410 Firmware M1140 Firmware Ms315 Firmware Ms415 Firmware Ms417 Firmware Ms51X Firmware Ms610Dn Firmware Ms617 Firmware M3150Dn Firmware Ms71X Firmware M5163Dn Firmware Ms810 Firmware Ms811 Firmware Ms812 Firmware Ms817 Firmware Ms818 Firmware Ms810De Firmware M5155 Firmware M5163 Firmware Ms812De Firmware M5170 Firmware Ms91X Firmware Xm1135 Firmware C746 Firmware C748 Firmware Cs748 Firmware C792 Firmware Cs796 Firmware C925 Firmware C950 Firmware C734 Firmware C736 Firmware E46X Firmware T65X Firmware W850 Firmware Cs51X Firmware Ms610De Firmware M3150 Firmware Xc2130 Firmware Xm1140 Firmware Lexmark

5.4

CVSS 3.1 · NVD

View

Vulnerability Assessment

Weakness	CWE CWE-79 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Output encoding, context-aware escaping MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS score of 5.4 (MEDIUM). Attack characteristics: network attack vector, low complexity, low privileges required, user interaction required.
Exploit ScenarioDerived	A remote attacker could inject malicious scripts into web pages viewed by other users by sending crafted requests to the affected application.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

No patch listed yet 0.7% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAI

A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Sanitize all user input, use Content-Security-Policy headers, encode output contextually (HTML, JS, URL). Use frameworks with built-in XSS protection.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

This vulnerability is classified as Cross-Site Scripting (XSS) (CWE-79), which allows attackers to inject malicious scripts into web pages viewed by other users. A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier. Affected products include: Lexmark Cs31X Firmware, Lexmark Cs41X Firmware, Lexmark Cs51X Firmware, Lexmark Cx310 Firmware, Lexmark Cx410 Firmware.

Know when M1145 Firmware gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

DescriptionNVD

A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier.

Threat Intelligence Overview

EPSS Score

0.7%

Top 53% exploitable

Data Quality

2 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.7%

Patch available No

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact· derived

Medium

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +27

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Cross-Site Scripting MEDIUM

Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.

Affected Products (CPE)NVD

cpe:2.3:o:lexmark:cs31x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:cs41x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:cs51x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:cx310_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:cx410_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:xc2130_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:cx510_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:xc2132_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms310_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms312_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms317_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms410_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:m1140_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms315_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms415_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms417_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms51x_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms610dn_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:ms617_firmware:*:*:*:*:*:*:*:*

cpe:2.3:o:lexmark:m1145_firmware:*:*:*:*:*:*:*:*

+ 60 more

More in M1145 Firmware

View all

CVE-2018-10662 CRITICAL Emergency POC

9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2018-10661 CRITICAL Emergency POC

9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2018-10660 CRITICAL Emergency POC

9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is

CVE-2018-10664 HIGH This Week POC

7.5 Jun 26

An issue was discovered in the httpd process in multiple models of Axis IP Cameras. Rated high severity (CVSS 7.5), this

CVE-2018-10663 HIGH This Week POC

7.5 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated high severity (CVSS 7.5), this vulnerability is rem

CVE-2018-10659 HIGH This Week POC

7.5 Jun 26

There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to ca

CVE-2018-10658 HIGH This Week POC

7.5 Jun 26

There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (c

CVE-2019-9933 CRITICAL Act Now

9.8 Aug 28

Various Lexmark products have a Buffer Overflow (issue 3 of 3). Rated critical severity (CVSS 9.8), this vulnerability i

CVE-2019-9932 CRITICAL Act Now

9.8 Aug 28

Various Lexmark products have a Buffer Overflow (issue 2 of 3). Rated critical severity (CVSS 9.8), this vulnerability i

CVE-2019-9930 CRITICAL Act Now

9.8 Aug 28

Various Lexmark products have an Integer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex

CVE-2019-10058 CRITICAL Act Now

9.1 Aug 28

Various Lexmark products have Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remote

CVE-2023-40239 HIGH This Week

7.5 Sep 01

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. Rated hi

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all

CVE-2020-3580 MEDIUM POC

6.1

CVE-2013-7389 MEDIUM POC

4.3

CVE-2021-25299 MEDIUM POC

6.1

CVE-2014-2120 MEDIUM

6.1

CVE-2023-40000 HIGH POC

8.3

CVE-2016-8581 MEDIUM POC

6.1

CVE-2013-5223 MEDIUM POC

5.4

CVE-2025-52367 MEDIUM POC

5.4

Same technique XSS

View all

CVE-2017-9248 CRITICAL POC

9.8

CVE-2013-1710 CRITICAL POC

10.0

CVE-2024-52875 HIGH POC

8.8

References

Advisories & patches

ADVISORY http://support.lexmark.com/index?page=content&id=TE936

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back