Published: 01/12/2011 Updated: 18/09/2012

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

VMScore: 890

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote malicious users to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.

Vulnerable Product	Search on Vulmon	Subscribe to Product
hp color laserjet 9500
hp color laserjet cm3530
hp color laserjet cp4005
hp color laserjet cp5525
hp color laserjet cp6015
hp laserjet 4250
hp laserjet 4345 mfp
hp laserjet m5035
hp laserjet m9040
hp laserjet enterprise 600 m602
hp laserjet enterprise 600 m603
hp color laserjet 3800
hp color laserjet 4700
hp color laserjet cm6030
hp color laserjet cm6040
hp color mfp cm8060 -
hp digital sender 9200c
hp laserjet 5200
hp laserjet 9040
hp laserjet p4014
hp laserjet p4015
hp color laserjet 3000
hp color laserjet cm4540 mfp
hp color laserjet cm4730 mfp
hp color laserjet enterprise cp4520
hp color laserjet enterprise cp4525
hp laserjet 4350
hp color laserjet 4730 mfp
hp laserjet m9050
hp laserjet p3005
hp laserjet enterprise m4555 mfp
hp laserjet enterprise p3015
hp color laserjet 5550
hp color laserjet cp3505
hp color laserjet cp3525
hp digital sender 9250c
hp laserjet 4240
hp laserjet 9050
hp laserjet m3035
hp laserjet p4515
hp laserjet enterprise 500 color m551
hp laserjet enterprise 600 m601

In November, 2011, a potential security vulnerability was identified with certain HP printers and HP digital senders The vulnerability could be exploited remotely to install unauthorized printer firmware This revision, version 6, of the Security Bulletin announces the availability of firmware updates for additional devices ...

CWE-264 https://lists.immunityinc.com/pipermail/dailydave/2011-November/000378.html http://redtape.msnbc.msn.com/_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say http://isc.sans.org/diary/Hacking+HP+Printers+for+Fun+and+Profit/12112 http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03102449 http://www.securityfocus.com/bid/51324 http://www.kb.cert.org/vuls/id/717921 http://www.securitytracker.com/id?1026357 http://secunia.com/advisories/47063 https://nvd.nist.gov https://www.kb.cert.org/vuls/id/717921

CVE-2011-4161

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect