CVE-2025-9269: Server-Side Request Forgery (SSRF) vulnerability found in embedded web server

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-09 · updated 2026-06-17
Weakness: CWE-918

Description

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the embedded web server in various Lexmark devices. This vulnerability can be leveraged by an attacker to force the device to send an arbitrary HTTP request to a third-party server. Successful exploitation of this vulnerability can lead to internal network access / potential data disclosure from a device.

Affected products

Lexmark CX, XC, CS, MS, MX, XM, et. al.: through CXTLS.250.199; through MXTLS.250.199; through CSTLS.250.199; through MSNSN.250.199; through MSTSN.250.199; through MXTSN.250.199

References

https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html

Get alerted when CVE-2025-9269 or the next vulnerability affects your stack