CVE-2018-17944: Lexmark CX725H Firmware

Medium severity, CVSS 4.9. EPSS: 0.9% chance of exploitation in the next 30 days.

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.

Affected products

• Lexmark CX725H Firmware: affected versions not specified
• Lexmark CX820 Firmware: affected versions not specified
• Lexmark CX825 Firmware: affected versions not specified
• Lexmark CX860 Firmware: affected versions not specified
• Lexmark XC4150 Firmware: affected versions not specified
• Lexmark XC6152 Firmware: affected versions not specified
• Lexmark XC8155 Firmware: affected versions not specified
• Lexmark XC8160 Firmware: affected versions not specified

Published 2019-03-12. Last modified 2026-06-17.