CVEvulnerability
CVE-2017-13771
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-09-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-522
Description
Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attackers to obtain sensitive information via requests to (1) cgi-bin/direct/printer/prtappauth/apps/snfDestServlet or (2) cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet.
Affected configurations
• lexmark scan to network (<= 3.2.9)
Related
Weakness · CWE (1)
- CWE-522 Insufficiently Protected Credentials weakness
References
- http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Aug/46 Exploit, Mailing List, Third Party Advisory
- https://support.lexmark.com/alerts support.lexmark.com
- http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information-Disclosure.html Exploit, Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2017/Aug/46 Exploit, Mailing List, Third Party Advisory
- https://support.lexmark.com/alerts support.lexmark.com