CVE-2025-65077: Lexmark Devices Path Traversal Flaw

CVE-2025-65077 Overview

A relative path traversal vulnerability (CWE-22) has been identified in the Embedded Solutions Framework across various Lexmark devices. This security flaw allows attackers to manipulate file paths to access directories and files outside the intended restricted location. By exploiting this vulnerability, an attacker can leverage the path traversal weakness to execute arbitrary code as an unprivileged user, potentially compromising the device and any sensitive data it handles.

Critical Impact

This network-accessible vulnerability enables remote attackers to execute arbitrary code on affected Lexmark devices without authentication, potentially leading to device takeover, data exfiltration, or lateral movement within corporate networks.

Affected Products

• Lexmark devices with Embedded Solutions Framework
• Various Lexmark printer and MFP models
• Lexmark enterprise device firmware

Discovery Timeline

• 2026-02-03 - CVE CVE-2025-65077 published to NVD
• 2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-65077

Vulnerability Analysis

This path traversal vulnerability exists within the Embedded Solutions Framework component of Lexmark devices. The vulnerability stems from insufficient validation of user-supplied input containing path traversal sequences. When the framework processes file path requests, it fails to properly sanitize relative path components such as ../ sequences, allowing attackers to escape the intended directory structure.

The network-accessible nature of this vulnerability means that attackers can exploit it remotely without requiring prior authentication. Once exploited, the attacker gains the ability to execute arbitrary code, though this execution occurs in the context of an unprivileged user rather than with elevated system privileges.

Root Cause

The root cause of CVE-2025-65077 lies in improper input validation within the Embedded Solutions Framework's file handling mechanisms. The framework fails to adequately neutralize special path elements before using them to construct file paths. Specifically, the code does not properly filter or reject path traversal sequences (../, ..\, or encoded variants), allowing attackers to reference parent directories and access files outside the application's designated directory scope.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no user interaction or authentication. An attacker can craft malicious requests containing relative path traversal sequences targeting the Embedded Solutions Framework interface. The attack flow typically involves:

1. Identifying a Lexmark device with the vulnerable Embedded Solutions Framework exposed to the network
2. Crafting HTTP requests containing path traversal sequences (e.g., ../../../) in file path parameters
3. Traversing the directory structure to access sensitive files or reach writable locations
4. Uploading or executing malicious payloads to achieve arbitrary code execution

The vulnerability can be exploited through specially crafted HTTP requests that include directory traversal sequences. These sequences allow the attacker to break out of the intended file path restrictions and access or manipulate files elsewhere on the device's file system. For detailed technical specifications, refer to the Lexmark Security Advisory.

Detection Methods for CVE-2025-65077

Indicators of Compromise

• Unusual HTTP requests to Lexmark device web interfaces containing ../ or encoded path traversal sequences (%2e%2e%2f)
• Unexpected file access patterns in device logs showing attempts to access system directories
• Anomalous code execution or process spawning on Lexmark devices
• Network traffic to Lexmark devices from unusual source IP addresses

Detection Strategies

• Implement network intrusion detection rules to identify HTTP requests containing path traversal patterns targeting Lexmark devices
• Monitor Lexmark device logs for file access attempts outside expected directories
• Deploy web application firewall (WAF) rules to filter requests with path traversal sequences
• Utilize SentinelOne Singularity platform to detect anomalous behavior on network-connected devices

Monitoring Recommendations

• Enable verbose logging on Lexmark devices where available to capture detailed request information
• Implement network segmentation monitoring to detect unusual traffic patterns to printer/MFP VLANs
• Configure SIEM alerts for path traversal patterns in web server logs across the enterprise
• Regularly audit Lexmark device firmware versions against known vulnerable releases

How to Mitigate CVE-2025-65077

Immediate Actions Required

• Review the Lexmark Security Advisory for specific patch availability and affected model information
• Isolate affected Lexmark devices from untrusted network segments immediately
• Implement network access controls to restrict access to Lexmark device management interfaces
• Audit network for all Lexmark devices running vulnerable Embedded Solutions Framework versions

Patch Information

Lexmark has published a security advisory addressing this vulnerability. Organizations should consult the official Lexmark Security Advisory page for specific firmware updates and patching instructions applicable to their device models. It is strongly recommended to apply vendor patches as soon as they become available for your specific Lexmark devices.

Workarounds

• Restrict network access to Lexmark device web interfaces using firewall rules or ACLs
• Place Lexmark devices on isolated network segments with limited connectivity
• Disable the Embedded Solutions Framework if not required for business operations
• Implement a web application firewall to filter path traversal sequences in requests to device interfaces

# Example network access restriction using iptables
# Restrict access to Lexmark device management port (typically 443/80) to trusted admin subnets
iptables -A INPUT -p tcp --dport 443 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.10.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP