Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2025-9269

Server-Side Request Forgery (SSRF) vulnerability found in embedded web server

Medium6.9EPSS 0.33%
Published
Updated
Reserved
Assigned by
Lexmark

Description

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.

Scores

CVSS scores of CVE-2025-9269, by who scored it
Scored byCVSSScoreVector
LexmarkCNA (assigner)4.0Medium6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
NVDNVD · Deferred4.0Medium6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.33% · top 73% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Weakness

Affected products

  • Lexmark · CX, XC, CS, MS, MX, XM, et. al.

    • affected ≤ CXTLS.250.199
    • affected ≤ MXTLS.250.199
    • affected ≤ CSTLS.250.199
    • affected ≤ MSNSN.250.199
    • affected ≤ MSTSN.250.199
    • affected ≤ MXTSN.250.199
    • affected ≤ CSNGV.250.199
    • affected ≤ CSTGV.250.199
    • affected ≤ CXTGV.250.199
    • affected ≤ CXTPC.250.199
    • affected ≤ CSTPC.250.199
    • affected ≤ MXTCT.250.199
    • affected ≤ MXTPM.250.199
    • affected ≤ CXTMM.250.199
    • affected ≤ CSTMM.250.199
    • affected ≤ MSNGM.250.199
    • affected ≤ MSTGM.250.199
    • affected ≤ MXNGM.250.199
    • affected ≤ MXTGM.250.199
    • affected ≤ MSNGW.250.199
    • affected ≤ MSTGW.250.199
    • affected ≤ MXTGW.250.199
    • affected ≤ CSTZJ.250.199
    • affected ≤ CSNZJ.250.199
    • affected ≤ CXTZJ.250.199
    • affected ≤ CXNZJ.250.199
    • affected ≤ MSLSG.230.466
    • affected ≤ MXLSG.230.466
    • affected ≤ MSLBD.230.466
    • affected ≤ MXLBD.230.466
    • affected ≤ CSLBN.230.466
    • affected ≤ CSLBL.230.466
    • affected ≤ CXLBN.230.466
    • affected ≤ CXLBL.230.466
    • affected ≤ CXTPP.230.466
    • affected ≤ CSTPP.230.466
    • affected ≤ CSTAT.230.466
    • affected ≤ CXTAT.230.466
    • affected ≤ CSTMH.230.466
    • affected ≤ CXTMH.230.466
    • and 19 more

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-9269 badge
[![CVE-2025-9269](https://trackcve.app/badge/CVE-2025-9269.svg)](https://trackcve.app/cve/CVE-2025-9269)

Record last updated .