Security vulnerabilities found in several HP printer models
Threat Intelligence from DigitalXRAID’s Security Operations Centre analysts:
HP have recently released two security advisories explaining security vulnerabilities found in several of its printer models. Three critical vulnerabilities and one high vulnerability have been found which can all lead to remote code execution if exploited by threat actors.
Read more about the CVE details here: CVE-2022-3942, CVE-2022-24291, CVE-2022-24292, and CVE-2022-24293
The CVSS (Common Vulnerability Scoring System) Severity Score has been rated as: 8.4, 7.5, 9.8, and 9.8 respectively.
CVE-2022-3942 relates to the Link-Local Multicast Name Resolution protocol (LLMNR), based on the DNS packet format. This allows both IPv4 and IPv6 hosts to perform name resolution on the same local link. Certain HP print products may be vulnerable to RCE and buffer overflow with the use of LLMNR. The remaining three vulnerabilities relate to potential information disclosure, Denial of Service or RCE.
There is a very long list of printer models which are affected by the first vulnerability. Every model of the following printers is included:
- HP Color LaserJet
- HP LaserJet
- HP PageWide
- HP Scanjet Enterprise
- HP DeskJet
- HP OfficeJet
- HP DesignJet
- HP Digital Sender Flow 8500 fn2 Document Capture Workstation
The models which are affected by the rest of the vulnerabilities are:
- HP Color LaserJet Pro M453 – M454, MFP M2XX, MFP M478, M479
- HP LaserJet Pro M304, M305, M404, M405, MFP M428, M429, MFP M428, M429 F
- HP PageWide 352dw Printer, 377dw Multifunction Printer,
- HP PageWide Managed P55250dw Printer series, P57750dw Multifunction Printer
- HP PageWide Pro 452dn Printer series, 452dw Printer series, 477dn Multifunction Printer series, 477dw Multifunction Printer series, 552dw Printer series, 577 Multifunction Printer series
- HP OfficeJet Pro 8210 Printer series, 8216 Printer series, 8730 All-in-One Printer, 8740 All-in-One Printer series
There are patches available for most of the vulnerabilities, which can be downloaded from the HP software and driver portal. The only devices which do not currently have a patch available are HP Color LaserJet Pro MFP M2xx models.
DigitalXRAID’s SOC (Security Operations Centre) Analysts recommend that any devices are patched and updated immediately.
If you discover that you’ve suffered a breach and need help urgently, get in contact with us. You can call our emergency line on 0800 066 4509 to speak to one of our experts. They’re available 24 hours a day, 7 days a week. Bookmark this page in case you ever need us.
If you need any support in mitigating any risks this vulnerability may have on your business, please don’t hesitate to get in contact.
