HP has released two updates to close the same number of security vulnerabilities that affect hundreds of printer models. Firmware updates that fix security vulnerabilities are available for some printer models.
The first security update confirms that some HP printer models are affected by CVE-2022-3942. The loophole allows remote execution code και υπερχείλισης buffer (buffer overflow) και χρησιμοποιεί το Link-Local Multicast Name Resolution (LLMNR). Η κρισιμότητα της informations is rated 8,4 out of 10.
The firmware updates released by HP concern the models:
- HP Color LaserJet Enterprise
- HP Color LaserJet Managed
- HP Digital Sender Flow
- HP LaserJet Enterprise 500
- HP LaserJet Enterprise Color Flow
- HP LaserJet Managed Flow
- HP LaserJet Enterprise Flow
- HP LaserJet Enterprise 600
- HP LaserJet Enterprise 700
- HP LaserJet Enterprise
- HP OfficeJet Enterprise Color
- HP PageWide Color
- HP PageWide Enterprise Color
- HP PageWide Enterprise Color Flow
- HP PageWide Managed Color
- HP Scanjet Enterprise 8500
- HP ScanJet Enterprise Flow
- HP Color LaserJet Pro
- HP LaserJet
- HP LaserJet Pro
- HP PageWide
- HP PageWide Pro
- HP PageWide Managed
- HP DeskJet
- HP DeskJet Ink Advantage
- HP DeskJet Plus
- HP DeskJet Plus Ink Advantage
- HP OfficeJet Pro
- HP DesignJet Z6 + Pro
- HP DesignJet Z9 + Pro
- HP DesignJet
- HP DesignJet XL
- HP PageWideXL
Owners and administrators of the above models should check the tables below to see if the printers they use are affected.
- HP Color LaserJet Pro - Disable unused network protocols and features using the Embedded Web Server (EWS)
- HP LaserJet Enterprise, HP PageWide Enterprise - Disable unused network protocols and features (EWS)
The second update fixes three vulnerabilities: CVE-2022-24291 with a score of 7,5, CVE-2022-24292 with a score of 9,8 and CVE-2022-24293 with a score of 9,8.
HP states that problems can be resolved by installing a new firmware release. The list of affected products is shorter:
- HP Color LaserJet Pro
- HP PageWide
- HP PageWide Managed
- HP OfficeJet Pro
The firmware is available for all affected printer models except the HP Color LaserJet Pro MFP M2XX.
HP printer owners will immediately upgrade their device firmware.
