Missing authentication in Lenovo LJ2206W Printer
Priority LOW 23CWE-306Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.
Summary
A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settings via the CUPS service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed LJ2206W Printer (Lenovo): Ver.D(1.05)M7206W Printer (Lenovo): Ver.F+10 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | LJ2206W Printer | before Ver.D(1.05) | Ver.D(1.05) | Patch available | CNA |
| Lenovo | M7206W Printer | before Ver.F | Ver.F | Patch available | CNA |
| Lenovo | M7216NWA Printer | before Ver.F | Ver.F | Patch available | CNA |
| Lenovo | M7256WHF Printer | before Ver.F | Ver.F | Patch available | CNA |
| Lenovo | LJ2655DN Printer | before Ver.E(1.06) | Ver.E(1.06) | Patch available | CNA |
| Lenovo | M7615DNA | before Ver.D | Ver.D | Patch available | CNA |
| Lenovo | M7626DNA Printer | before Ver.D | Ver.D | Patch available | CNA |
| Lenovo | M7628DNA Printer | before Ver.D | Ver.D | Patch available | CNA |
| Lenovo | M7455DNF Printer | before Ver.E | Ver.E | Patch available | CNA |
| Lenovo | M7675DXF Printer | before Ver.E | Ver.E | Patch available | CNA |
| Lenovo | M7685DXF Printer | before Ver.E | Ver.E | Patch available | CNA |
| Lenovo | M7686DXF | before Ver.E | Ver.E | Patch available | CNA |
- LJ2206W Printer VendorLenovo Affected before Ver.D(1.05) Fixed in Ver.D(1.05) Patch available CNA
- M7206W Printer VendorLenovo Affected before Ver.F Fixed in Ver.F Patch available CNA
- M7216NWA Printer VendorLenovo Affected before Ver.F Fixed in Ver.F Patch available CNA
- M7256WHF Printer VendorLenovo Affected before Ver.F Fixed in Ver.F Patch available CNA
- LJ2655DN Printer VendorLenovo Affected before Ver.E(1.06) Fixed in Ver.E(1.06) Patch available CNA
- M7615DNA VendorLenovo Affected before Ver.D Fixed in Ver.D Patch available CNA
- M7626DNA Printer VendorLenovo Affected before Ver.D Fixed in Ver.D Patch available CNA
- M7628DNA Printer VendorLenovo Affected before Ver.D Fixed in Ver.D Patch available CNA
- M7455DNF Printer VendorLenovo Affected before Ver.E Fixed in Ver.E Patch available CNA
- M7675DXF Printer VendorLenovo Affected before Ver.E Fixed in Ver.E Patch available CNA
- M7685DXF Printer VendorLenovo Affected before Ver.E Fixed in Ver.E Patch available CNA
- M7686DXF VendorLenovo Affected before Ver.E Fixed in Ver.E Patch available CNA
Remediation
- Fix · CNA LJ2206W Printer (Lenovo) Fixed in Ver.D(1.05)
- Fix · CNA M7206W Printer (Lenovo) Fixed in Ver.F
- Fix · CNA M7216NWA Printer (Lenovo) Fixed in Ver.F
- Fix · CNA M7256WHF Printer (Lenovo) Fixed in Ver.F
- Fix · CNA LJ2655DN Printer (Lenovo) Fixed in Ver.E(1.06)
- Fix · CNA M7615DNA (Lenovo) Fixed in Ver.D
- Fix · CNA M7626DNA Printer (Lenovo) Fixed in Ver.D
- Fix · CNA M7628DNA Printer (Lenovo) Fixed in Ver.D
- Fix · CNA M7455DNF Printer (Lenovo) Fixed in Ver.E
- Fix · CNA M7675DXF Printer (Lenovo) Fixed in Ver.E
- Fix · CNA M7685DXF Printer (Lenovo) Fixed in Ver.E
- Fix · CNA M7686DXF (Lenovo) Fixed in Ver.E
Timeline
- 2026-10-02 Threatist record created from CVE-2025-9214
- 2026-10-03 Alias added: GHSA-crhp-6474-j87m
References
More Lenovo vulnerabilities
- TI-2017-03639 Improper handling of exceptional conditions in Apache Struts KEVCVSS 3.1CRITICAL 9.8
- TI-2024-07516 Insecure Platform Key (PK) used in UEFI system firmware signature CVSS 3.1MEDIUM 6.4
- TI-2017-13070 OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory… CVSS 3.0CRITICAL 9.8
- TI-2017-02875 OS command injection in Lenovo Service Framework application CVSS 3.0CRITICAL 9.8
- TI-2013-01192 Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate… CVSS 2.0HIGH 9.3
- TI-2026-53163 Hard-coded credentials in Lenovo Health Application CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-9214 · CVE Program
- CVE-2025-9214 · NVD
- FIRST EPSS
- GHSA-crhp-6474-j87m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences