Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-17944

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.

Published

2019-03-12T16:29:00.220

Last Modified

2024-11-21T03:55:15.330

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 4.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-200
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System lexmark cx725h_firmware - Yes
Hardware lexmark cx725h - No
Operating System lexmark cx820_firmware - Yes
Hardware lexmark cx820 - No
Operating System lexmark cx825_firmware - Yes
Hardware lexmark cx825 - No
Operating System lexmark cx860_firmware - Yes
Hardware lexmark cx860 - No
Operating System lexmark xc4150_firmware - Yes
Hardware lexmark xc4150 - No
Operating System lexmark xc6152_firmware - Yes
Hardware lexmark xc6152 - No
Operating System lexmark xc8155_firmware - Yes
Hardware lexmark xc8155 - No
Operating System lexmark xc8160_firmware - Yes
Hardware lexmark xc8160 - No
References