CVE-2017-13771

Lexmark Scan To Network (SNF) 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests, which allows remote attackers to obtain sensitive information via requests to (1) cgi-bin/direct/printer/prtappauth/apps/snfDestServlet or (2) cgi-bin/direct/printer/prtappauth/apps/ImportExportServlet.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

5.0 MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS

3.36% chance of exploitation in the next 30 days, 88th percentile

Published

2017-09-07

Updated

2024-08-05

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/143975/Lexmark-Scan-To-Network-SNF-3.2.9-Information…
• http://seclists.org/fulldisclosure/2017/Aug/46

References

• CVE Record
• NVD entry

Related

• CVE-2017-13754
• CVE-2017-13772
• CVE-2017-13734
• CVE-2017-13783
• CVE-2017-13733
• CVE-2017-13784