TI-2018-11073 Aliases CVE-2018-15520 GHSA-jx8x-49cm-p262

Various Lexmark devices have a Buffer Overflow (issue 2 of 2).

MEDIUM 44CWE-119Published 2019-06-28 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Various Lexmark devices have a Buffer Overflow (issue 2 of 2).

Why it matters now

EPSS 0.01196 68th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 68

CPE	Versions	Role	Vendor
cpe:2.3:o:lexmark:cx82x_firmware::::::::	up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx82x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:cx860_firmware::::::::	up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx860:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc6152_firmware::::::::	up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc6152:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc8155_firmware::::::::	up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc8155:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc8160_firmware::::::::	up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc8160:-:::::::*	not specified by NVD	Running on	Lexmark

cpe:2.3:o:lexmark:cx82x_firmware:*:*:*:*:*:*:*:* Versions up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx82x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:cx860_firmware:*:*:*:*:*:*:*:* Versions up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc6152_firmware:*:*:*:*:*:*:*:* Versions up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc6152:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc8155_firmware:*:*:*:*:*:*:*:* Versions up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc8155:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc8160_firmware:*:*:*:*:*:*:*:* Versions up to cxtpp.052.024; cxtpp.052.200 – cxtpp.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc8160:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark

Show 58 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:lexmark:cx72x_firmware::::::::	up to cxtat.052.024; cxtat.052.200 – cxtat.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx72x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc41x0_firmware::::::::	up to cxtat.052.024; cxtat.052.200 – cxtat.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc41x0:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:cx92x_firmware::::::::	up to cxtmh.052.024; cxtmh.052.200 – cxtmh.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx92x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc92x5_firmware::::::::	up to cxtmh.052.024; cxtmh.052.200 – cxtmh.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc92x5:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx321_firmware::::::::	up to mxngm.052.024; mxngm.052.200 – mxngm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx321:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mb2338_firmware::::::::	up to mxngm.052.024; mxngm.052.200 – mxngm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mb2338:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx42x_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx42x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx52x_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx52x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx622_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx622:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mb2442_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mb2442:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mb2546_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mb2546:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mb2650_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mb2650:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xm124x_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xm124x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xm3250_firmware::::::::	up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xm3250:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx72x_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx72x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mx82x_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mx82x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mb2770_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mb2770:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xm5370_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xm5370:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xm7355_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xm7355:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xm7370_firmware::::::::	up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xm7370:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:cx421_firmware::::::::	up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx421:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mc2325_firmware::::::::	up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mc2325:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mc2425_firmware::::::::	up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mc2425:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:cx522_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx522:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:cx62x_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:cx62x:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mc2535_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mc2535:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:mc2640_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:mc2640:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc2235_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc2235:-:::::::*	not specified by NVD	Running on	Lexmark
cpe:2.3:o:lexmark:xc4240_firmware::::::::	up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204	Vulnerable	Lexmark
cpe:2.3:h:lexmark:xc4240:-:::::::*	not specified by NVD	Running on	Lexmark

cpe:2.3:o:lexmark:cx72x_firmware:*:*:*:*:*:*:*:* Versions up to cxtat.052.024; cxtat.052.200 – cxtat.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx72x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc41x0_firmware:*:*:*:*:*:*:*:* Versions up to cxtat.052.024; cxtat.052.200 – cxtat.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc41x0:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:cx92x_firmware:*:*:*:*:*:*:*:* Versions up to cxtmh.052.024; cxtmh.052.200 – cxtmh.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx92x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc92x5_firmware:*:*:*:*:*:*:*:* Versions up to cxtmh.052.024; cxtmh.052.200 – cxtmh.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc92x5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx321_firmware:*:*:*:*:*:*:*:* Versions up to mxngm.052.024; mxngm.052.200 – mxngm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mb2338_firmware:*:*:*:*:*:*:*:* Versions up to mxngm.052.024; mxngm.052.200 – mxngm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mb2338:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx42x_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx42x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx52x_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx52x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx622_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx622:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mb2442_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mb2442:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mb2546_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mb2546:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mb2650_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mb2650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xm124x_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xm124x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xm3250_firmware:*:*:*:*:*:*:*:* Versions up to mxtgm.052.024; mxtgm.052.200 – mxtgm.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xm3250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx72x_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx72x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mx82x_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mx82x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mb2770_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mb2770:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xm5370_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xm5370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xm7355_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xm7355:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xm7370_firmware:*:*:*:*:*:*:*:* Versions up to mxtgw.052.024; mxtgw.052.200 – mxtgw.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xm7370:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:cx421_firmware:*:*:*:*:*:*:*:* Versions up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx421:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mc2325_firmware:*:*:*:*:*:*:*:* Versions up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mc2325:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mc2425_firmware:*:*:*:*:*:*:*:* Versions up to cxnzj.052.024; cxnzj.052.200 – cxnzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mc2425:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:cx522_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx522:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:cx62x_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:cx62x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mc2535_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mc2535:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:mc2640_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:mc2640:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc2235_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc2235:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark
cpe:2.3:o:lexmark:xc4240_firmware:*:*:*:*:*:*:*:* Versions up to cxtzj.052.024; cxtzj.052.200 – cxtzj.052.204 Vulnerable ·Lexmark
cpe:2.3:h:lexmark:xc4240:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lexmark

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2018-15520
2026-10-03 Alias added: GHSA-jx8x-49cm-p262

References

Advisory 1

http://support.lexmark.com/index?page=content&id=TE892

TI-2023-09391 In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. CVSS 3.1CRITICAL 9.8
TI-2023-09090 Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. CVSS 3.1HIGH 7.5
TI-2021-20249 Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07. CVSS 3.1CRITICAL 9.8
TI-2021-20248 Embedded web server input sanitization vulnerability in Lexmark devices through… CVSS 3.1CRITICAL 9.8
TI-2021-20252 Buffer overflow vulnerability has been identified in Lexmark devices through 2021-12-07 in postscript interpreter. CVSS 3.1CRITICAL 9.8
TI-2021-20251 PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be… CVSS 3.1HIGH 8.8

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences

Various Lexmark devices have a Buffer Overflow (issue 2 of 2).

Key facts

Summary

Why it matters now

SSVC decision points

Affected products

CPE configurations NVD · 68

Remediation

Timeline

References

Advisory 1

More Lexmark Cx421 Firmware vulnerabilities

Sources