CVE-2025-9214

MediumCVSS 5.4/10Last modified Oct 18, 2026

Description

A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settings via the CUPS service.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-306

Affected software

VendorProductVersions
LenovoLJ2206W Printer< Ver.D(1.05)
LenovoM7206W Printer< Ver.F
LenovoM7216NWA Printer< Ver.F
LenovoM7256WHF Printer< Ver.F
LenovoLJ2655DN Printer< Ver.E(1.06)
LenovoM7615DNA< Ver.D
LenovoM7626DNA Printer< Ver.D
LenovoM7628DNA Printer< Ver.D
LenovoM7455DNF Printer< Ver.E
LenovoM7675DXF Printer< Ver.E
LenovoM7685DXF Printer< Ver.E
LenovoM7686DXF< Ver.E

References

Timeline

Published
Sep 11, 2025
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-92156.5The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerableCVE-2025-92168.8The StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More plugin for WordPress is vulnerableCVE-2025-92176.5The Slider Revolution plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.7.36 via the 'used_svg' aCVE-2025-92183.7The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to to Information Disclosure due to missing authorizatiCVE-2025-92194.3The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SESCVE-2025-92225.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 CVE-2025-92238.8Zohocorp ManageEngine Applications Manager versions 178100 and below are vulnerable to authenticated command injection vulnerability due to CVE-2025-92255.5Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution CVE-2025-92264.6Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerCVE-2025-92276.5Zohocorp ManageEngine OpManager versions 128609 and below are vulnerable to Stored XSS Vulnerability in the SNMP trap processor.CVE-2025-92284.3MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege userCVE-2025-92295.3Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detai
CVE-2025-9214: Medium severity, CVSS 5.4 | Vulnix