Lexmark Printers Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-17944)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(503857);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/21");

  script_cve_id("CVE-2018-17944");

  script_name(english:"Lexmark Printers Exposure of Sensitive Information to an Unauthorized Actor (CVE-2018-17944)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"On certain Lexmark devices that communicate with an LDAP or SMTP
server, a malicious administrator can discover LDAP or SMTP
credentials by changing that server's hostname to one that they
control, and then capturing the credentials that are sent there. This
occurs because stored credentials are not automatically deleted upon
that type of hostname change.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
# script_set_attribute(attribute:"see_also", value:"http://support.lexmark.com/index?page=content&id=TE909");
# script_set_attribute(attribute:"see_also", value:"http://support.lexmark.com/index?page=content&id=TE909");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-17944");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(200);

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/03/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2019/03/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/05");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:cx725h_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:cx820_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:cx825_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:cx860_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:xc4150_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:xc6152_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:xc8155_firmware:-");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:lexmark:xc8160_firmware:-");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/LexmarkInternational");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/LexmarkInternational');

var asset = tenable_ot::assets::get(vendor:'LexmarkInternational');

var vuln_cpes = {
    "cpe:/o:lexmark:cx725h_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:cx820_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:cx825_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:cx860_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:xc4150_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:xc6152_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:xc8155_firmware:-" :
        {"family" : "LexmarkInternational"},
    "cpe:/o:lexmark:xc8160_firmware:-" :
        {"family" : "LexmarkInternational"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);