CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2023-40239
Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure. The fixed firmware version is LW80.*.P246, i.e., '*' indicates that the full version specification varies across product model family, but firmware level P246 (or higher) is required to remediate the vulnerability.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-611
- Published
- Modified
- Record from
- the NVD, synced
Affected
- lexmark:c2132_firmware
- lexmark:cs310_firmware
- lexmark:cs317_firmware
- lexmark:cs410_firmware
- lexmark:cs417_firmware
- lexmark:cs510_firmware
- lexmark:cs517_firmware
- lexmark:cx310_firmware
- lexmark:cx317_firmware
- lexmark:cx410_firmware
- lexmark:cx417_firmware
- lexmark:cx510_firmware
- lexmark:cx517_firmware
- lexmark:m1140\+_firmware
- lexmark:m1140_firmware
- lexmark:m1145_firmware
- lexmark:m3150de_firmware
- lexmark:m3150dn_firmware
- lexmark:m5155_firmware
- lexmark:m5163de_firmware
- lexmark:m5163dn_firmware
- lexmark:m5170_firmware
- lexmark:ms310_firmware
- lexmark:ms312_firmware
- lexmark:ms315_firmware
- lexmark:ms317_firmware
- lexmark:ms410_firmware
- lexmark:ms415_firmware
- lexmark:ms417_firmware
- lexmark:ms510_firmware
- lexmark:ms517_firmware
- lexmark:ms610de_firmware
- lexmark:ms610dn_firmware
- lexmark:ms617_firmware
- lexmark:ms710_firmware
- lexmark:ms711_firmware
- lexmark:ms810de_firmware
- lexmark:ms810dn_firmware
- lexmark:ms811_firmware
- lexmark:ms812de_firmware
- lexmark:ms812dn_firmware
- lexmark:ms817_firmware
- lexmark:ms818_firmware
- lexmark:ms911_firmware
- lexmark:mx310_firmware
- lexmark:mx317_firmware
- lexmark:mx410_firmware
- lexmark:mx417_firmware
- lexmark:mx510_firmware
- lexmark:mx511_firmware