dbcve.org
CWE-426Weakness · CWE-426

CVE-2025-65078

CRITICAL · 9.3 CVSS v4.0 Published 2026-02-03
Mitigation only
No fix yet — a mitigation exists. There is no fixed release. A documented workaround reduces exposure in the meantime.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged by an attacker to execute arbitrary code.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

An untrusted search path vulnerability in Lexmark's Embedded Solutions Framework allows attackers to execute arbitrary code by placing malicious executables in directories that get searched before legitimate ones. This type of flaw typically stems from improper PATH handling or insecure executable lookup mechanisms within the embedded firmware.

MitigationApply the vendor-supplied firmware update from Lexmark to patch the Embedded Solutions Framework. If no update is available, restrict physical and network access to the device and monitor for signs of compromise.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Confirm Lexmark device and ESF presence
    Identify the device model via web UI, SNMP, or command line (e.g., 'ls -la /mnt/fs0/etc/board_id' or similar). Check if the Lexmark Embedded Solutions Framework is installed by reviewing the firmware image or device capabilities list.
    Affected if The device is a Lexmark printer/MFP and runs the Embedded Solutions Framework.
  2. Locate ESF executable search paths
    Within the embedded firmware, examine the PATH environment variable or configuration files that define executable lookup order for ESF applications. Look for paths that are writable or accessible (e.g., /tmp, /var, USB mount points).
    Affected if The search path includes directories that could be modified by an attacker (e.g., USB storage, writable partitions).
  3. Identify ESF module or application directory
    Find the directory where ESF loads or executes its plugins/extensions. Common locations may include /opt/ESF, /mnt/esf, or vendor-specific paths. List contents and check for unexpected executables.
    Affected if The ESF application directory contains files not originally shipped with the firmware or contains executables with unusual timestamps/ownership.
  4. Review ESF configuration for path settings
    Examine ESF configuration files (XML, JSON, or proprietary formats) for any configurable search paths, plugin directories, or execution paths. Determine if user-defined paths are accepted.
    Affected if ESF accepts user-supplied paths for loading modules or if it defaults to world-writable locations.
  5. Check for unauthorized ESF processes
    If accessible via shell, run 'ps' or equivalent to list running processes started by ESF. Compare against known legitimate ESF processes. Look for unexpected binaries or scripts.
    Affected if ESF is executing binaries outside the expected vendor distribution directory.

A user is affected if they operate a Lexmark device with Embedded Solutions Framework enabled where the executable search path includes directories writable by an attacker.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

From vendor data
Mitigation available No clean upgrade yet — mitigate in the meantime
Mitigation

Apply the vendor-supplied firmware update from Lexmark to patch the Embedded Solutions Framework. If no update is available, restrict physical and network access to the device and monitor for signs of compromise.

Have this fixed Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing6.0 h
  • Review / QA4.0 h
22.0 hours of engineering $3,860
Get help mitigating

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $6,176.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-65078 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-65078 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data