Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-50733 is a high-severity Improper Input Validation (CWE-20) vulnerability in Lexmark (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique LSASS Memory (T1003.001); ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-50733 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Web Services feature in newer Lexmark devices. Published on 2025-01-21, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) and maps to CWE-20 (Improper Input Validation) and CWE-918 (Server-Side Request Forgery).
Unauthenticated attackers with network access can exploit this vulnerability with low complexity and no user interaction. Exploitation enables high confidentiality impact across a changed scope, allowing remote adversaries to potentially trick the device into making unauthorized requests to internal or external resources.
Mitigation details are available in the Lexmark security advisory at https://www.lexmark.com/en_us/solutions/security/lexmark-security-advisories.html.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55489
Vulnerability Data
A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Web Services feature of newer Lexmark devices.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.3.6V1.5.3V5.3.2V10.4.7
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.
Developer testing and evaluation can discover missing input validation through analysis or test cases.
SI-10 directly requires validity checks on information inputs, structurally preventing improper or missing validation.
Requiring documented development standards and tools can embed input-validation practices into the engineering process.
Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Secure development practices directly include input validation and destination allow-listing that prevent SSRF.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-20, a class-level weakness, and none of its children carries one either.