CVE-2025-65078: Lexmark Embedded Solutions RCE Flaw

CVE-2025-65078 Overview

An untrusted search path vulnerability has been identified in the Embedded Solutions Framework used in various Lexmark devices. This vulnerability allows an attacker to execute arbitrary code by exploiting how the framework resolves and loads libraries or executables from untrusted locations. The flaw stems from improper validation of the search path, enabling attackers to place malicious files in locations that are searched before legitimate system directories.

Critical Impact
This vulnerability enables remote arbitrary code execution on affected Lexmark devices without requiring authentication or user interaction, potentially allowing complete device compromise.

Affected Products

Lexmark devices running the Embedded Solutions Framework
Various Lexmark printer and multifunction device models
Devices with vulnerable firmware versions (refer to Lexmark Security Advisories for specific models)

Discovery Timeline

2026-02-03 - CVE-2025-65078 published to NVD
2026-02-04 - Last updated in NVD database

Technical Details for CVE-2025-65078

Vulnerability Analysis

This vulnerability is classified under CWE-426 (Untrusted Search Path), which occurs when an application searches for critical resources using an externally-supplied search path that can be modified by untrusted parties. In the context of the Lexmark Embedded Solutions Framework, the application fails to properly restrict the directories from which it loads dynamic libraries or executables.

The vulnerability is particularly dangerous because it can be exploited remotely over the network without requiring any user interaction or prior authentication. An attacker who successfully exploits this flaw gains the ability to execute code with the privileges of the affected application, potentially leading to complete device takeover.

Root Cause

The root cause of this vulnerability lies in the improper handling of the search path within the Embedded Solutions Framework. When the framework attempts to load libraries or execute programs, it searches through a sequence of directories. If this search path includes directories that are writable by attackers or can be influenced through network-accessible mechanisms, malicious actors can introduce rogue files that will be loaded instead of legitimate system components.

The framework does not adequately validate or sanitize the search path, allowing external manipulation. This is a common pattern in embedded systems where security hardening may be less rigorous than in traditional computing environments.

Attack Vector

The attack can be conducted remotely over the network. An attacker would need to:

Identify an affected Lexmark device accessible on the network
Determine a method to place a malicious file in a location that precedes legitimate directories in the search path
Trigger the vulnerable functionality that causes the framework to search for and load the malicious file
Achieve arbitrary code execution with the privileges of the Embedded Solutions Framework

The lack of required authentication or user interaction makes this vulnerability particularly severe, as it can be exploited in automated attacks against vulnerable devices.

Detection Methods for CVE-2025-65078

Indicators of Compromise

Unexpected files appearing in directories associated with the Embedded Solutions Framework
Anomalous outbound network connections from Lexmark devices
Unusual process behavior or resource utilization on affected printers
Modified configuration files or firmware settings

Detection Strategies

Monitor network traffic to and from Lexmark devices for suspicious patterns
Implement network segmentation to isolate printing infrastructure from untrusted networks
Deploy intrusion detection systems (IDS) with rules for detecting exploitation attempts targeting embedded devices
Conduct regular firmware integrity checks on Lexmark devices

Monitoring Recommendations

Enable comprehensive logging on Lexmark devices where available
Monitor for unauthorized configuration changes through device management consoles
Establish baseline network behavior for printing devices and alert on deviations
Integrate Lexmark device logs with SIEM solutions for centralized monitoring

How to Mitigate CVE-2025-65078

Immediate Actions Required

Review the Lexmark Security Advisories for affected device models and available patches
Isolate vulnerable Lexmark devices from untrusted network segments
Restrict network access to management interfaces using firewall rules
Disable unnecessary services and features on affected devices until patches are applied

Patch Information

Lexmark has released information regarding this vulnerability through their security advisories portal. Organizations should consult the Lexmark Security Advisories page for specific firmware updates and patching instructions applicable to their device models. Apply the latest firmware updates as soon as they become available to remediate this vulnerability.

Workarounds

Implement strict network access controls limiting which systems can communicate with Lexmark devices
Place affected devices on isolated VLANs with restricted internet access
Disable remote management features if not operationally required
Monitor device activity closely while awaiting official patches
Consider temporarily taking highly sensitive devices offline if risk is unacceptable