Skip to main content

M1145 Firmware CVE-2023-40239

HIGH
Improper Restriction of XML External Entity Reference (CWE-611)
2023-09-01 cve@mitre.org
Information Disclosure XXE M1145 Firmware Xm5163 Firmware Xm5170 Firmware Xm7155 Firmware Xm7163 Firmware Xm7170 Firmware Cx310 Firmware Cx410 Firmware Cx510 Firmware Xc2132 Firmware Mx410 Firmware Mx510 Firmware Mx511 Firmware Xm1145 Firmware Mx610 Firmware Mx611 Firmware Xm3150 Firmware Ms310 Firmware Ms312 Firmware Ms317 Firmware Ms410 Firmware M1140 Firmware Ms315 Firmware Ms415 Firmware Ms417 Firmware Ms610Dn Firmware Ms617 Firmware M3150Dn Firmware M5163Dn Firmware Ms811 Firmware Ms817 Firmware Ms818 Firmware Ms810De Firmware M5155 Firmware Ms812De Firmware M5170 Firmware Xm1135 Firmware Ms610De Firmware Xc2130 Firmware Xm1140 Firmware C2132 Firmware Cs310 Firmware Cs317 Firmware Cs410 Firmware Cs417 Firmware Cs510 Firmware Cs517 Firmware Cx317 Firmware Cx417 Firmware Cx517 Firmware M3150De Firmware M5163De Firmware Ms510 Firmware Ms517 Firmware Ms710 Firmware Ms711 Firmware Ms810Dn Firmware Ms812Dn Firmware Ms911 Firmware Mx310 Firmware Mx317 Firmware Mx417 Firmware Mx517 Firmware Mx617 Firmware Mx710 Firmware Mx711 Firmware Mx717 Firmware Mx718 Firmware Mx810 Firmware Mx811 Firmware Mx812 Firmware Mx910 Firmware Mx911 Firmware Mx912 Firmware Xm5263 Firmware Xm5270 Firmware Xm7263 Firmware Xm7270 Firmware Xm9145 Firmware Xm9155 Firmware Xm9165 Firmware Lexmark
7.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Sep 01, 2023 - 11:15 nvd
HIGH 7.5

DescriptionNVD

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.

AnalysisAI

Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability. Affected products include: Lexmark C2132 Firmware, Lexmark Cs310 Firmware, Lexmark Cs317 Firmware, Lexmark Cs410 Firmware, Lexmark Cs417 Firmware. Version information: before 2023.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Disable external entity processing in XML parsers, use JSON instead of XML where possible.

More in M1145 Firmware

View all
CVE-2018-10662 CRITICAL POC
9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2018-10661 CRITICAL POC
9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2018-10660 CRITICAL POC
9.8 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated critical severity (CVSS 9.8), this vulnerability is
CVE-2018-10664 HIGH POC
7.5 Jun 26

An issue was discovered in the httpd process in multiple models of Axis IP Cameras. Rated high severity (CVSS 7.5), this
CVE-2018-10663 HIGH POC
7.5 Jun 26

An issue was discovered in multiple models of Axis IP Cameras. Rated high severity (CVSS 7.5), this vulnerability is rem
CVE-2018-10659 HIGH POC
7.5 Jun 26

There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which allows remote attackers to ca
CVE-2018-10658 HIGH POC
7.5 Jun 26

There was a Memory Corruption issue discovered in multiple models of Axis IP Cameras which causes a denial of service (c
CVE-2019-9933 CRITICAL
9.8 Aug 28

Various Lexmark products have a Buffer Overflow (issue 3 of 3). Rated critical severity (CVSS 9.8), this vulnerability i
CVE-2019-9932 CRITICAL
9.8 Aug 28

Various Lexmark products have a Buffer Overflow (issue 2 of 3). Rated critical severity (CVSS 9.8), this vulnerability i
CVE-2019-9930 CRITICAL
9.8 Aug 28

Various Lexmark products have an Integer Overflow. Rated critical severity (CVSS 9.8), this vulnerability is remotely ex
CVE-2019-10058 CRITICAL
9.1 Aug 28

Various Lexmark products have Incorrect Access Control. Rated critical severity (CVSS 9.1), this vulnerability is remote
CVE-2019-9931 HIGH
7.5 Aug 28

Various Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash th

Same weakness CWE-611 – Improper Restriction of XML External Entity Reference

View all
CVE-2019-9670 CRITICAL POC
9.8
CVE-2025-58360 HIGH POC
8.2
CVE-2025-2775 CRITICAL POC
9.3
CVE-2025-2776 CRITICAL POC
9.3
CVE-2017-12629 CRITICAL POC
9.8
CVE-2016-9563 MEDIUM POC
6.5
CVE-2012-3363 CRITICAL POC
9.1
CVE-2016-4264 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2023-40239 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy