Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Name | Vendor | Start Version | End Version |
---|---|---|---|
8100c_digital_sender | Hp | - (including) | - (including) |
9100c_digital_sender | Hp | - (including) | - (including) |
9200c_digital_sender | Hp | - (including) | - (including) |
9250c_digital_sender | Hp | - (including) | - (including) |
Color_laserjet | Hp | * | * |
Color_laserjet_1500 | Hp | * | * |
Color_laserjet_2500 | Hp | * | * |
Color_laserjet_2500l | Hp | * | * |
Color_laserjet_2500lse | Hp | * | * |
Color_laserjet_2500n | Hp | * | * |
Color_laserjet_2500tn | Hp | * | * |
Color_laserjet_2605dtn | Hp | * | * |
Color_laserjet_4370mfp | Hp | 20081211_46.211.2 (including) | 20081211_46.211.2 (including) |
Color_laserjet_4600 | Hp | * | * |
Color_laserjet_4600dn | Hp | * | * |
Color_laserjet_4600dtn | Hp | * | * |
Color_laserjet_4600hdn | Hp | * | * |
Color_laserjet_4650 | Hp | * | * |
Color_laserjet_4700 | Hp | * | * |
Color_laserjet_4730_mfp | Hp | * | * |
Color_laserjet_5500 | Hp | * | * |
Color_laserjet_5550 | Hp | * | * |
Color_laserjet_8500 | Hp | * | * |
Color_laserjet_8550 | Hp | * | * |
Color_laserjet_9500 | Hp | * | * |
Color_laserjet_9500_mfp | Hp | * | * |
Color_laserjet_9500mfp | Hp | 20070719_05.011.2 (including) | 20070719_05.011.2 (including) |
Color_mfp_cm8050 | Hp | - (including) | - (including) |
Color_mfp_cm8060 | Hp | - (including) | - (including) |
Digital_senders | Hp | * | * |
Edgeline_printers | Hp | * | * |
Laserjet_1000 | Hp | * | * |
Laserjet_1005 | Hp | * | * |
Laserjet_1010 | Hp | * | * |
Laserjet_1012 | Hp | * | * |
Laserjet_1015 | Hp | * | * |
Laserjet_1018 | Hp | * | * |
Laserjet_1018s | Hp | * | * |
Laserjet_1020 | Hp | * | * |
Laserjet_1020_plus | Hp | * | * |
Laserjet_1022 | Hp | * | * |
Laserjet_1022n | Hp | * | * |
Laserjet_1022nw | Hp | * | * |
Laserjet_1100 | Hp | * | * |
Laserjet_1150 | Hp | * | * |
Laserjet_1160 | Hp | * | * |
Laserjet_1200 | Hp | * | * |
Laserjet_1300 | Hp | * | * |
Laserjet_1320 | Hp | * | * |
Laserjet_2 | Hp | * | * |
Laserjet_2000 | Hp | * | * |
Laserjet_2100 | Hp | * | * |
Laserjet_2200 | Hp | * | * |
Laserjet_2200dtn | Hp | * | * |
Laserjet_2300 | Hp | * | * |
Laserjet_2300dn | Hp | * | * |
Laserjet_2400 | Hp | * | * |
Laserjet_2410 | Hp | 20070410_08.112.3 (including) | 20070410_08.112.3 (including) |
Laserjet_2420 | Hp | 20070410_08.112.3 (including) | 20070410_08.112.3 (including) |
Laserjet_2430 | Hp | * | * |
Laserjet_2430 | Hp | 20070410_08.112.3 (including) | 20070410_08.112.3 (including) |
Laserjet_2500 | Hp | * | * |
Laserjet_2500c | Hp | * | * |
Laserjet_2600c | Hp | * | * |
Laserjet_2600n | Hp | * | * |
Laserjet_3000 | Hp | * | * |
Laserjet_3700 | Hp | * | * |
Laserjet_4 | Hp | * | * |
Laserjet_4/4m | Hp | * | * |
Laserjet_4_plus/m_plus | Hp | * | * |
Laserjet_4000 | Hp | * | * |
Laserjet_4000n | Hp | * | * |
Laserjet_4050 | Hp | * | * |
Laserjet_4100 | Hp | * | * |
Laserjet_4100_mfp | Hp | * | * |
Laserjet_4100mfp | Hp | * | * |
Laserjet_4200 | Hp | * | * |
Laserjet_4200dtn | Hp | * | * |
Laserjet_4200ln | Hp | * | * |
Laserjet_4240 | Hp | * | * |
Laserjet_4240n | Hp | * | * |
Laserjet_4250 | Hp | * | * |
Laserjet_4250 | Hp | 20080319_08.015.0 (including) | 20080319_08.015.0 (including) |
Laserjet_4300 | Hp | * | * |
Laserjet_4345_mfp | Hp | * | * |
Laserjet_4345mfp | Hp | 20081211_09.131.1 (including) | 20081211_09.131.1 (including) |
Laserjet_4350 | Hp | * | * |
Laserjet_4350 | Hp | 20080319_08.015.0 (including) | 20080319_08.015.0 (including) |
Laserjet_4350dtn | Hp | * | * |
Laserjet_4650dn | Hp | * | * |
Laserjet_4l/ml | Hp | * | * |
Laserjet_4m_plus | Hp | * | * |
Laserjet_4p/mp | Hp | * | * |
Laserjet_4si | Hp | * | * |
Laserjet_4v/mv | Hp | * | * |
Laserjet_5 | Hp | * | * |
Laserjet_5/m/n | Hp | * | * |
Laserjet_500_plus | Hp | * | * |
Laserjet_5000 | Hp | * | * |
Laserjet_5000 | Hp | r.25.15 (including) | r.25.15 (including) |
Laserjet_5000 | Hp | r.25.47 (including) | r.25.47 (including) |
Laserjet_5100 | Hp | * | * |
Laserjet_5100 | Hp | v.29.12 (including) | v.29.12 (including) |
Laserjet_5100dtn | Hp | * | * |
Laserjet_5200 | Hp | * | * |
Laserjet_5l | Hp | * | * |
Laserjet_5m | Hp | * | * |
Laserjet_5p/mp | Hp | * | * |
Laserjet_5si | Hp | * | * |
Laserjet_8000 | Hp | * | * |
Laserjet_8100 | Hp | * | * |
Laserjet_8150 | Hp | * | * |
Laserjet_8150dn | Hp | * | * |
Laserjet_9000 | Hp | * | * |
Laserjet_9000_mfp | Hp | * | * |
Laserjet_9000mfp | Hp | * | * |
Laserjet_9040 | Hp | * | * |
Laserjet_9040 | Hp | 20080204_08.110.0 (including) | 20080204_08.110.0 (including) |
Laserjet_9040mfp | Hp | * | * |
Laserjet_9040mfp | Hp | 20080204_08.110.0 (including) | 20080204_08.110.0 (including) |
Laserjet_9050 | Hp | * | * |
Laserjet_9050 | Hp | 20080204_08.110.0 (including) | 20080204_08.110.0 (including) |
Laserjet_9050_mfp | Hp | * | * |
Laserjet_9050mfp | Hp | * | * |
Laserjet_9050mfp | Hp | 20080204_08.110.0 (including) | 20080204_08.110.0 (including) |
Laserjet_9055 | Hp | * | * |
Laserjet_9065 | Hp | * | * |
Laserjet_9500 | Hp | * | * |
Laserjet_9500mfp | Hp | * | * |
Laserjet_ii | Hp | * | * |
Laserjet_iid | Hp | * | * |
Laserjet_iii | Hp | * | * |
Laserjet_iiid | Hp | * | * |
Laserjet_iiip | Hp | * | * |
Laserjet_iiisi | Hp | * | * |
Laserjet_iip | Hp | * | * |
Laserjet_iip_plus | Hp | * | * |
Laserjet_m1522n_mfp | Hp | * | * |
Laserjet_m3027_mfp | Hp | * | * |
Laserjet_m3035_mfp | Hp | * | * |
Laserjet_m4345_mfp | Hp | * | * |
Laserjet_m5025_mfp | Hp | * | * |
Laserjet_m5035_mfp | Hp | * | * |
Laserjet_p1000 | Hp | * | * |
Laserjet_p1005 | Hp | * | * |
Laserjet_p1006 | Hp | * | * |
Laserjet_p1007 | Hp | * | * |
Laserjet_p1008 | Hp | * | * |
Laserjet_p1009 | Hp | * | * |
Laserjet_p1500 | Hp | * | * |
Laserjet_p1505 | Hp | * | * |
Laserjet_p1505n | Hp | * | * |
Laserjet_p2000 | Hp | * | * |
Laserjet_p2010 | Hp | * | * |
Laserjet_p2015 | Hp | * | * |
Laserjet_p2030 | Hp | * | * |
Laserjet_p2050 | Hp | * | * |
Laserjet_p3000 | Hp | * | * |
Laserjet_p3005 | Hp | * | * |
Laserjet_p4010 | Hp | * | * |
Laserjet_p4014 | Hp | * | * |
Laserjet_p4015 | Hp | * | * |
Laserjet_p4500 | Hp | * | * |
Laserjet_p4510 | Hp | * | * |