CVE-2025-65077: Lexmark Path Traversal Vulnerability

CVE-2025-65077 Overview

CVE-2025-65077 is a relative path traversal vulnerability in the Embedded Solutions Framework (ESF) used across multiple Lexmark printer and multifunction device models. An attacker can leverage the flaw to execute arbitrary code as an unprivileged user on affected devices. The vulnerability is classified under CWE-22 and is exploitable over the network without authentication or user interaction. Lexmark has acknowledged the issue through its security advisory portal.

Critical Impact

Unauthenticated network-based attackers can traverse directory paths to execute arbitrary code on affected Lexmark devices, compromising printing infrastructure and providing a foothold into enterprise networks.

Affected Products

• Lexmark devices running the Embedded Solutions Framework (ESF)
• Refer to the Lexmark Security Advisories for the complete list of affected models
• Specific firmware versions enumerated in Lexmark's advisory

Discovery Timeline

• 2026-02-03 - CVE-2025-65077 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-65077

Vulnerability Analysis

The vulnerability resides in the Embedded Solutions Framework, a Lexmark platform that allows applications and workflows to run directly on printers and multifunction devices. The framework fails to properly validate or canonicalize file path inputs supplied through network-accessible interfaces. An attacker can craft requests containing relative path sequences such as ../ to escape the intended working directory.

Once path validation is bypassed, the attacker can place or reference files outside the permitted scope. The result is arbitrary code execution in the context of an unprivileged user account on the device. While code runs unprivileged, it still provides a persistent foothold on networked devices that frequently sit in trusted segments of enterprise networks.

Root Cause

The root cause is insufficient input sanitization on file path parameters processed by ESF components. The framework accepts user-controlled path strings and resolves them without enforcing a canonical base directory boundary. This CWE-22 weakness allows attackers to reference files in arbitrary filesystem locations relative to the application context.

Attack Vector

The attack is delivered over the network against the printer's exposed ESF services. No authentication or user interaction is required. An attacker on the same network segment, or one with routable access to printer management interfaces, can submit crafted requests containing traversal sequences. Successful exploitation yields arbitrary code execution as an unprivileged user, suitable for reconnaissance, lateral movement staging, and persistence on the device.

No verified public exploit code is currently available. Technical details should be reviewed in the Lexmark Security Advisories.

Detection Methods for CVE-2025-65077

Indicators of Compromise

• HTTP or service-layer requests to Lexmark device endpoints containing ../, ..\, or URL-encoded traversal sequences such as %2e%2e%2f
• Unexpected outbound network connections originating from printer or multifunction device IP addresses
• Unusual processes or workflows registered through the Embedded Solutions Framework that were not deployed by administrators
• Authentication or session activity from printer devices to internal systems outside normal print or scan workflows

Detection Strategies

• Inspect network traffic destined for Lexmark device management ports for path traversal patterns in request URIs and parameters
• Compare installed ESF applications against an approved baseline and flag unauthorized additions
• Correlate printer-originated network flows with expected behavior such as SMB scan-to-folder or LDAP authentication, and alert on deviations

Monitoring Recommendations

• Forward printer syslog and device event logs to a centralized analytics platform for retention and correlation
• Place printers on segmented VLANs and monitor inter-VLAN traffic for unexpected protocols or destinations
• Establish behavioral baselines for each printer model and alert on configuration changes, new application installs, or atypical outbound connections

How to Mitigate CVE-2025-65077

Immediate Actions Required

• Apply the firmware updates referenced in the Lexmark Security Advisories to all affected devices
• Inventory every Lexmark device in the environment and cross-reference firmware versions against the advisory
• Restrict network access to printer management interfaces using ACLs or firewall rules, limiting reachability to authorized administrative hosts
• Disable the Embedded Solutions Framework on devices where it is not actively used

Patch Information

Lexmark has published firmware updates that remediate the path traversal flaw in the Embedded Solutions Framework. Consult the Lexmark Security Advisories page for the specific firmware build numbers corresponding to each affected device family. Deploy firmware through Lexmark Markvision Enterprise or the device web interface following the vendor's update procedure.

Workarounds

• Segment printers onto a dedicated VLAN with strict ingress and egress filtering until firmware updates can be deployed
• Block inbound access to printer HTTP, HTTPS, and ESF service ports from untrusted networks at the perimeter and internal firewalls
• Disable unused services and protocols on each device including raw print, FTP, and Telnet to reduce attack surface
• Require administrative authentication for any configuration changes and rotate default credentials

# Example firewall rule to restrict printer management access to admin subnet only
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.0.0/16 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.20.0.0/16 -p tcp --dport 443 -j DROP
iptables -A FORWARD -d 10.20.0.0/16 -p tcp --dport 80 -j DROP