CVE-2025-1127

CVE-2025-1127 is a critical vulnerability (CVSS score 9.1, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) published on 2025-02-13, associated with CWE-22 (Path Traversal) and CWE-362 (Race Condition). It affects Lexmark products, as referenced in their security advisories. The flaw allows an attacker to execute arbitrary code as an unprivileged user and/or modify the contents of any data on the filesystem.

Exploitation requires high privileges (PR:H) and network access (AV:N) with low attack complexity and no user interaction. A privileged attacker can leverage this over the network to achieve arbitrary code execution running as an unprivileged user, alongside full filesystem modification capabilities, with changed scope (S:C) leading to high confidentiality, integrity, and availability impacts.

Lexmark's security advisories, available at https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html, provide details on mitigation and patches for this vulnerability.