HP Printer Hijack Bugs Impact 150 Models

Security researchers have found out two vulnerabilities in multi-perform printers (MFPs) which impacted 150 products designs.

F-Secure security consultants Timo Hirvonen and Alexander Bolshev have prepared up their results in a specific report, Printing Shellz.

Specially, they located a bodily access port vulnerability (CVE-2021-39237) and a font parsing bug (CVE-2021-39238) in HP’s MFP M725z machine. They turned out to impact scores a lot more merchandise in the FutureSmart line courting back again to 2013.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper take secure and enxrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized seller: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

CVE-2021-3928 is the a lot more hazardous of the two as it can be exploited remotely, potentially by tricking an worker into traveling to a malicious web page, to conduct a “cross-website printing” attack. Below, the website would automatically print a doc made up of a maliciously crafted font on a vulnerable MFP, said F-Protected.

This would permit an attacker to execute arbitrary code on the machine to steal any printed, scanned or faxed details, such as system passwords.

The report claimed that it could also enable attackers to launch further attacks into the corporate network to unfold ransomware, steal data from extra sensitive data suppliers and achieve other targets.

The bugs are also wormable, that means many MFPs on the exact network could be immediately impacted.

“It’s simple to fail to remember that present day MFPs are absolutely-practical pcs that menace actors can compromise just like other workstations and endpoints. And just like other endpoints, attackers can leverage a compromised gadget to injury an organization’s infrastructure and operations,” defined F-Secure’s Hirvonen.

“Experienced risk actors see unsecured products as chances, so corporations that don’t prioritize securing their MFPs like other endpoints go away themselves exposed to attacks like the ones documented in our exploration.”

HP has issued patches for the vulnerabilities, which are described as “medium” (CVE-2021-39237) and critical severity (CVE-2021-39238).

Whilst they are only believed to be exploitable by superior specific attackers, enterprises had been urged to patch them as quickly as probable.