CVE-2023-35175

Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request…

published June 30, 2023

CVSS
—
EPSS
1%
Percentile
73.0
In the wild
Unconfirmed
What it is

⚡ HP LaserJet Pro printers have a potential weakness that could let sneaky attackers execute code remotely or escalate privileges through a crafty Server-Side Request Forgery (SSRF)! 🖨️ Think of your printer as a hotel concierge. If an attacker can trick the concierge into calling any room without proper verification, they could potentially access sensitive information or execute unauthorized actions inside the hotel. If exploited, this vulnerability could allow an attacker to execute malicious commands on the printer, potentially leading to unauthorized access to sensitive documents or even compromising the entire network. A compromised printer could become the gateway for further attacks within your organization's infrastructure, making this a serious concern.

Put simply

Think of your printer as a hotel concierge. If an attacker can trick the concierge into calling any room without proper verification, they could potentially access sensitive information or execute unauthorized actions inside the hotel. The vulnerability stems from how certain HP LaserJet Pro models handle Server-Side Request Forgery (SSRF) via the Web Service Eventing model. This flaw allows an attacker to send crafted requests that the printer processes, which could lead to remote code execution or privilege escalation.

What to do

If exploited, this vulnerability could allow an attacker to execute malicious commands on the printer, potentially leading to unauthorized access to sensitive documents or even compromising the entire network. A compromised printer could become the gateway for further attacks within your organization's infrastructure, making this a serious concern. To protect yourself, ensure that your printer's firmware is updated to the latest version provided by HP. Additionally, review and limit external access to your printer’s web services to reduce potential attack vectors. Regularly check for any security advisories from HP. You've got this! With a few simple steps, you can secure your printer and your network like a pro! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01443 · 73.0th percentile
Published
2023-06-30T15:43Z
EPSS history
Timeline
  • 30 JUN 15:43Z
    Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request…
    cvelistv5