PT-2022-1904 · Hewlett Packard · Hp Print Devices

Published 2022-01-21 · Updated 2022-03-29 · CVE-2022-24292

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HP Print devices (affected versions not specified)

Description The issue is related to a buffer overflow in the PostScript interpreter of HP Print devices, which can lead to information disclosure, denial of service, or remote code execution. An attacker could exploit this to execute arbitrary code remotely. The vulnerability has been demonstrated in real-world scenarios, such as the Pwn2Own event, where it was used to exploit an HP LaserJet Pro MFP M283fdw device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Over-read

Weakness Enumeration

CWE-126

Related Identifiers

BDU:2022-01440

CVE-2022-24292

ZDI-22-535

Affected Products

Hp Print Devices

References · 9

• https://zerodayinitiative.com/advisories/ZDI-22-535 · Security Note
• https://bdu.fstec.ru/vul/2022-01440 · Security Note
• https://support.hp.com/us-en/document/ish_5950417-5950443-16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24292 · Security Note
• https://t.me/true_secator/2766 · Telegram Post
• https://xakep.ru/2022/03/22/hp-rce-flaws · Note
• https://habr.com/ru/news/t/657035 · Note
• https://t.me/cibsecurity/39440 · Telegram Post