CVE-2025-1127— Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
Quick assessment
Affected
Lexmark CX, XC, CS, MS, MX, XM, et. al.
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Lexmark是美国利盟（Lexmark）公司的一系列打印机。 Lexmark存在安全漏洞，该漏洞源于存在组合路径遍历和并发执行漏洞，会导致攻击者可执行任意代码和/或修改文件系统上任何数据的内容。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-1127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Combination Path Traversal and Concurrent Execution vulnerability exists within the embedded web server
Source: CVE Program / CVE List V5
Vulnerability Description
The vulnerability can be leveraged by an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Lexmark 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Lexmark是美国利盟（Lexmark）公司的一系列打印机。 Lexmark存在安全漏洞，该漏洞源于存在组合路径遍历和并发执行漏洞，会导致攻击者可执行任意代码和/或修改文件系统上任何数据的内容。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Lexmark | CX, XC, CS, MS, MX, XM, et. al. | 0 ~ CXTLS.240.205 | - |
|
II. Public POCs for CVE-2025-1127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
default-local-qwen3.6
· 11539 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2025-1127
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-1127 (1)
IV. Related Vulnerabilities
Same product: CX, XC, CS, MS, MX, XM, et. al.
-
CVE-2025-9269
Server-Side Request Forgery (SSRF) vulnerability found in em -
CVE-2024-11346
Access of Resource Using Incompatible Type in Postscript int -
CVE-2024-11344
Type confusion vulnerability in the Postscript interpreter i -
CVE-2024-11345
Heap-based memory vulnerability in the Postscript interprete
Same vendor: Lexmark
-
CVE-2025-65078
Untrusted search path vulnerability in Embedded Solutions Fr -
CVE-2025-65077
Relative path traversal vulnerability in Embedded Solutions -
CVE-2025-65081
Out-of-bounds read vulnerability in Postscript interpreter -
CVE-2025-65080
Type confusion vulnerability in Postscript interpreter -
CVE-2025-65079
Heap-based buffer overflow vulnerability in Postscript inter
Same weakness: CWE-22
-
CVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overw -
CVE-2026-75875
Multiple vulnerabilities affect the Sniffer component as par -
CVE-2026-82900
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-84247
IBM Guardium Data Protection is affected by multiple vulnera -
CVE-2026-19493
Security vulnerabilities have been found in IBM Verify Ident
V. Comments for CVE-2025-1127
No comments yet