You do not have permission to edit this page, for the following reasons:
== Assessment scope == Documentation-based Common Criteria evaluated deployment: CX635adwe in Security Target v1.20 dated 10 September 2024, CXTGV.222.037, standard TPM and installed HDD P/N 27X0805. Use controlled physical access and an attached security lock, configured individual local Username/Password accounts with unique credentials and minimum length 15, protected functions, IPsec for all relevant remote-IT datagrams, Notice-level auditing and a remote syslog server. Configure login restriction threshold 3 failures within 5 minutes and 5-minute lockout. These are explicit literature conditions; no actual printer was configured or tested. Exact Security Target guarantees take precedence over later generic guidance. == Method and evidence boundaries == This is a documentary case-study assessment of the exact hardware, firmware and explicitly stated configuration, reviewed on 24 October 2026. No physical installation, penetration test or traffic capture by the author is claimed. Historical flaws do not establish current unpatched exposure. The website supplies qualitative categories rather than statistical thresholds: repeated real maintenance supports Updatability 1; isolated/uncertain maintenance supports2; a documented no-update condition supports3. Vulnerability/attack frequency labels are reasoned judgments, and a laboratory demonstration is not an observed campaign. None for prior attacks means no exact-model field campaign established in the reviewed sources, not proof of lifetime absence. Communications follows the least-protected enabled path carrying control, credentials or application payloads; a DNS/discovery packet alone is not used to label an entire device unencrypted. Storage evaluates confidential device-resident flash contents, not merely cloud security or whether executable firmware is readable. For Passwords, the methodology discusses first-setup credentials and expressly allows unique initial passwords. Where mandatory first-use creation or explicitly configured unique credentials do not match a shared-default-change label literally, option2 is a disclosed functional mapping, not a claim of forced periodic rotation. Option1 additionally requires enforced complexity; option3 requires positive evidence of common, predictable or unprotected access. Dates preserve the identified manufacturer announcement/availability or clearly identified primary regional catalog basis. No arbitrary first-of-month date is inserted. The calculated IDRS device grade is not a manufacturer certification or a student assignment mark. Calculated IDRS: 2 + 1 + 2 = 5 (A-). Date basis: Official Lexmark CX635adwe EPD, Product Description, Introduction Date 4/25/2023, North American market. This is an explicit original introduction-date field. Date source: https://csr.lexmark.com/env-epd_28_2557794239.pdf Product-specific boundaries: This grade applies to the exact evaluated hardware, firmware and explicitly configured enterprise deployment; it is not a stock-default rating. The exact2024 Security Target is authoritative. The March 2025 general administrator guide is later supporting guidance, not evidence that every later feature was present in 222.037. All remote-IT datagrams use IPsec in this deployment. Analog fax/PSTN lies outside that network encryption boundary. Older222.037 predates the2025 CVE fix; the specified administrator password supplies the vendor-stated untrusted-user mitigation. Password2 follows the declared unique-initial-credential interpretation, not a fabricated automatic rotation rule. == Hardware and general-information supplement == Supplement reviewed on 25 October 2026. Manufacturer model specifications and explicitly identified historical manuals support the added fields. Hardware capabilities do not imply that optional services, accessories or every capacity variant are enabled in the assessed case. Unpublished or unverified parameters are identified rather than guessed. Current sale/support status is separate from the original historical firmware/configuration assessment; the twelve security selections and original evidence have not been changed. === Specification evidence === * Generation, Battery: [https://csr.lexmark.com/env-epd_28_2557794239.pdf source 1]. * Status, Dimensions, Mass, Memory, Display, Camera: [https://www.lexmark.com/en_xc/printers/printer/27915/Lexmark-CX635adwe source 1]. * Operating system, Companion App, Storage: [https://www.commoncriteriaportal.org/nfs/ccpfiles/files/epfiles/628-LSS%20Lexmark%20MFP%20Fax%20HD%20ST.pdf source 1]. * CPU: [https://www.commoncriteriaportal.org/nfs/ccpfiles/files/epfiles/628-LSS%20Lexmark%20MFP%20Fax%20HD%20ST.pdf source 1]; [https://www.lexmark.com/en_xc/printers/printer/27915/Lexmark-CX635adwe source 2]. * GPU, Connectivity: [https://www.lexmark.com/en_xc/printers/printer/27915/Lexmark-CX635adwe source 1]; [https://www.commoncriteriaportal.org/nfs/ccpfiles/files/epfiles/628-LSS%20Lexmark%20MFP%20Fax%20HD%20ST.pdf source 2]. * Power: [https://support.lexmark.com/content/dam/support/collateral/lexmark_hardware/cx53x_cx63x/ug/pdf/Lexmark_CX532_CX635_XC2335_XC2342_UserGuide_en.pdf source 1]; [https://www.lexmark.com/en_xc/printers/printer/27915/Lexmark-CX635adwe source 2]. * Charging: [https://csr.lexmark.com/env-epd_28_2557794239.pdf source 1]; [https://support.lexmark.com/content/dam/support/collateral/lexmark_hardware/cx53x_cx63x/ug/pdf/Lexmark_CX532_CX635_XC2335_XC2342_UserGuide_en.pdf source 2]. * Sound: [https://www.lexmark.com/content/dam/lexmark/collateral/brochures/emea/master/CX635adwe-Brochure.pdf source 1]. === Specification qualifications === * The assessed Common Criteria configuration retains HDD P/N 27X0805; a different optional storage product is not assumed. * Wireless and USB document-processing capabilities exist in the product but are disabled in the assessed Common Criteria deployment. * Physical/power specifications do not establish new security behavior for the historical CXTGV.222.037 firmware. * The optional Status selector is left unset: the reviewed sources do not establish a reliable current sale/end-of-sale/end-of-life category. Firmware maintenance or an existing product page alone is not treated as proof of sale status.
For new submissions, pages will appear blank until approval.
Summary: This is a minor edit Watch this page
Save page Show preview Show changes Cancel
