CVE-2018-17944 - CVE House
Back to Database
Status published Medium CVE-2018-17944

On certain Lexmark devices that communicate with an LDAP or...

Vulnerability Description

On certain Lexmark devices that communicate with an LDAP or SMTP server, a malicious administrator can discover LDAP or SMTP credentials by changing that server's hostname to one that they control, and then capturing the credentials that are sent there. This occurs because stored credentials are not automatically deleted upon that type of hostname change.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-17944

Credits & Attribution

No credits recorded in the NVD database.

References

More from lexmark

View All →
CVE-2022-29850
Various Lexmark products through 2022-04-27 allow an attacker who has...
High 8.1
CVE-2022-24935
Lexmark products through 2022-02-10 have Incorrect Access Control....
High 7.5
CVE-2021-44738
Buffer overflow vulnerability has been identified in Lexmark devices through...
Critical 9.8
CVE-2021-44737
PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that...
High 8.8
CVE-2021-44736
The initial admin account setup wizard on Lexmark devices allow...
Critical 9.8

Affected Vendor

Affected Software

cx725h firmware, cx820 firmware, cx825 firmware, cx860 firmware, xc4150 firmware, xc6152 firmware, xc8155 firmware, xc8160 firmware
Vulnerable Versions:
Unknown

Timeline

Official Publish: March 12th, 2019
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.