What is the CVSS score of CVE-2023-40239?

CVE-2023-40239 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

C2132 Firmware CVE-2023-40239

HIGH

Improper Restriction of XML External Entity Reference (CWE-611)

2023-09-01 cve@mitre.org

Information Disclosure XXE C2132 Firmware Cs310 Firmware Cs317 Firmware Cs410 Firmware Cs417 Firmware Cs510 Firmware Cs517 Firmware Cx310 Firmware Cx317 Firmware Cx410 Firmware Cx417 Firmware Cx510 Firmware Cx517 Firmware M1140 Firmware M1145 Firmware M3150De Firmware M3150Dn Firmware M5155 Firmware M5163De Firmware M5163Dn Firmware M5170 Firmware Ms310 Firmware Ms312 Firmware Ms315 Firmware Ms317 Firmware Ms410 Firmware Ms415 Firmware Ms417 Firmware Ms510 Firmware Ms517 Firmware Ms610De Firmware Ms610Dn Firmware Ms617 Firmware Ms710 Firmware Ms711 Firmware Ms810De Firmware Ms810Dn Firmware Ms811 Firmware Ms812De Firmware Ms812Dn Firmware Ms817 Firmware Ms818 Firmware Ms911 Firmware Mx310 Firmware Mx317 Firmware Mx410 Firmware Mx417 Firmware Mx510 Firmware Mx511 Firmware Mx517 Firmware Mx610 Firmware Mx611 Firmware Mx617 Firmware Mx710 Firmware Mx711 Firmware Mx717 Firmware Mx718 Firmware Mx810 Firmware Mx811 Firmware Mx812 Firmware Mx910 Firmware Mx911 Firmware Mx912 Firmware Xc2130 Firmware Xc2132 Firmware Xm1135 Firmware Xm1140 Firmware Xm1145 Firmware Xm3150 Firmware Xm5163 Firmware Xm5170 Firmware Xm5263 Firmware Xm5270 Firmware Xm7155 Firmware Xm7163 Firmware Xm7170 Firmware Xm7263 Firmware Xm7270 Firmware Xm9145 Firmware Xm9155 Firmware Xm9165 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Sep 01, 2023 - 11:15 nvd

HIGH 7.5

DescriptionNVD

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.

AnalysisAI

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability. Affected products include: Lexmark C2132 Firmware, Lexmark Cs310 Firmware, Lexmark Cs317 Firmware, Lexmark Cs410 Firmware, Lexmark Cs417 Firmware. Version information: before 2023.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.