CVE-2017-13771

CRITICAL

Lexmark Scan TO Network < 3.2.9 - Insufficiently Protected Credentials

Title source: rule

Description

Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attackers to obtain sensitive information via requests to (1) cgi-bin/direct/printer/prtappauth/apps/snfDestServlet or (2) cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet.

References (3)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information-Disclosure.html

[Exploit, Mailing List, Third Party Advisory] http://seclists.org/fulldisclosure/2017/Aug/46

[Various Sources] https://support.lexmark.com/alerts

Scores

CVSS v3 9.8

EPSS 0.0153

EPSS Percentile 81.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-522

Status draft

Affected Products (1)

lexmark/scan_to_network < 3.2.9

Timeline

Published Sep 07, 2017

Tracked Since Feb 18, 2026