More than 150 HP printers are vulnerable to two bugs that could give hackers full access to the devices, according to security firm F-Secure.
“In our quest to enhance our attack simulation capabilities while learning hardware security, we discovered two very different methods for gaining full control over HP [multi-function printers] MFPs: exposed connectors for shell access and a memory corruption issue in the font parser,” F-Secure says in a technical breakdown of its findings. “The former requires physical access to the device but the latter can be exploited remotely—even directly from a malicious website.”
The initial research was conducted on an HP MFP M725z running firmware that was released in 2013. F-Secure says it later discovered that more recent versions of the firmware were affected by the vulnerabilities as well. HP released patches for both flaws on Nov. 1 to “certain HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers” and disclosed the vulnerabilities as CVE-2021-39237 and CVE-2021-39238.
This means that some 150 models of HP printers and firmware dating back at least eight years were vulnerable before F-Secure discovered the flaws. Luckily the impact of both vulnerabilities should be mitigated by the effort required to exploit them.
“The good news is that the attackers have budgets too,” F-Secure says, “and a font parser bug in an MFP is unlikely the low hanging fruit that the attackers would pick to target a typical organization.”
Organizations using affected HP printers should install the latest firmware updates to defend their machines. HP also says that “customers concerned about potential physical attacks,” similar to the one that F-Secure demonstrated by exploiting CVE-2021-39237, “should follow the recommendation in the product user guide to use a Kensington-style lock to protect against these and other potential types of physical attacks on HP printers.”
A full list of affected printers is below.
