← Vulnerability feed

Vulnerability record · CVE-2020-10094 · published 28 April 2020

CVE-2020-10094: Lexmark cs31x firmware cross-site scripting vulnerability

Lexmark · Cs31x Firmware

A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier.

5.4 CVSS 3.1 Medium EPSS 0.65% · top 50.7% CWE-79 · Cross-site scripting
5.4CVSS 3.1 base score, v2 3.5
0.65%EPSS exploitation probability, 30 days
NoNot in CISA KEV
80Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A cross-site scripting (XSS) vulnerability in Lexmark CS31x before LW74.VYL.P273; CS41x before LW74.VY2.P273; CS51x before LW74.VY4.P273; CX310 before LW74.GM2.P273; CX410 & XC2130 before LW74.GM4.P273; CX510 & XC2132 before LW74.GM7.P273; MS310, MS312, MS317 before LW74.PRL.P273; MS410, M1140 before LW74.PRL.P273; MS315, MS415, MS417 before LW74.TL2.P273; MS51x, MS610dn, MS617 before LW74.PR2.P273; M1145, M3150dn before LW74.PR2.P273; MS610de, M3150 before LW74.PR4.P273; MS71x,M5163dn before LW74.DN2.P273; MS810, MS811, MS812, MS817, MS818 before LW74.DN2.P273; MS810de, M5155, M5163 before LW74.DN4.P273; MS812de, M5170 before LW74.DN7.P273; MS91x before LW74.SA.P273; MX31x, XM1135 before LW74.SB2.P273; MX410, MX510 & MX511 before LW74.SB4.P273; XM1140, XM1145 before LW74.SB4.P273; MX610 & MX611 before LW74.SB7.P273; XM3150 before LW74.SB7.P273; MX71x, MX81x before LW74.TU.P273; XM51xx & XM71xx before LW74.TU.P273; MX91x & XM91x before LW74.MG.P273; MX6500e before LW74.JD.P273; C746 before LHS60.CM2.P738; C748, CS748 before LHS60.CM4.P738; C792, CS796 before LHS60.HC.P738; C925 before LHS60.HV.P738; C950 before LHS60.TP.P738; X548 & XS548 before LHS60.VK.P738; X74x & XS748 before LHS60.NY.P738; X792 & XS79x before LHS60.MR.P738; X925 & XS925 before LHS60.HK.P738; X95x & XS95x before LHS60.TQ.P738; 6500e before LHS60.JR.P738;C734 LR.SK.P824 and earlier; C736 LR.SKE.P824 and earlier; E46x LR.LBH.P824 and earlier; T65x LR.JP.P824 and earlier; X46x LR.BS.P824 and earlier; X65x LR.MN.P824 and earlier; X73x LR.FL.P824 and earlier; W850 LP.JB.P823 and earlier; and X86x LP.SP.P823 and earlier.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

80 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://support.lexmark.com/index?page=content&id=TE936 Vendor Advisory
http://support.lexmark.com/index?page=content&id=TE936 Vendor Advisory

Track CVE-2020-10094 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2019-9930Lexmark cs31x firmware integer overflow vulnerabilityVarious Lexmark products have an Integer Overflow.EPSS 1.5%9.8CVE-2019-9932Lexmark cs31x firmware memory buffer overflow vulnerabilityVarious Lexmark products have a Buffer Overflow (issue 2 of 3).EPSS 1.5%9.8CVE-2019-9933Lexmark cs31x firmware memory buffer overflow vulnerabilityVarious Lexmark products have a Buffer Overflow (issue 3 of 3).EPSS 1.5%9.1CVE-2019-10058Lexmark cs31x firmware vulnerabilityVarious Lexmark products have Incorrect Access Control.EPSS 1.1%7.5CVE-2018-18894Lexmark 6500e firmware path traversal vulnerabilityCertain older Lexmark devices (C, M, X, and 6500e before 2018-12-18) contain a directory traversal vulnerability in the embedded web server.EPSS 1.7%7.5CVE-2011-3269Lexmark x950 firmware information exposure vulnerabilityLexmark X, W, T, E, C, 6500e, and 25xxN devices before 2011-11-15 allow attackers to obtain sensitive information via a hidden email address in a Sca…EPSS 1.1%7.5CVE-2019-9931Lexmark cs31x firmware vulnerabilityVarious Lexmark printers contain a denial of service vulnerability in the SNMP service that can be exploited to crash the device.EPSS 1.1%5.4CVE-2020-10093Lexmark cs31x firmware cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability in Lexmark Pro910 series inkjet and other discontinued products.EPSS 0.66%

Source: NIST National Vulnerability Database (record CVE-2020-10094), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.