PT-2022-1905 · Hewlett Packard · Hp Laserjet Pro Mfp M283Fdw+1

Published 2022-01-21 · Updated 2022-03-29 · CVE-2022-24293

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HP Print devices (affected versions not specified)

Description The issue is related to a stack-based buffer overflow in the firmware of HP Print devices. This could allow a remote attacker to execute arbitrary code, potentially leading to information disclosure, denial of service, or remote code execution. The vulnerability was demonstrated at Pwn2Own, specifically affecting the HP LaserJet Pro MFP M283fdw through an eContactRestore stack-based buffer overflow, enabling remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2022-01441

CVE-2022-24293

ZDI-22-533

Affected Products

Hp Laserjet Pro Mfp M283Fdw

Hp Print Devices

References · 9

• https://bdu.fstec.ru/vul/2022-01441 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-533 · Security Note
• https://support.hp.com/us-en/document/ish_5950417-5950443-16 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24293 · Security Note
• https://osv.dev/vulnerability/CVE-2022-24293 · Vendor Advisory
• https://t.me/cibsecurity/39457 · Telegram Post
• https://t.me/true_secator/2766 · Telegram Post
• https://xakep.ru/2022/03/22/hp-rce-flaws · Note
• https://habr.com/ru/news/t/657035 · Note