Printing Shellz – 8-year-old HP printer vulnerability affects 150 printer models

guest · Dec 6, 2021

November 30, 2021

Researchers have discovered several vulnerabilities affecting at least 150 multi-function (print, scan, fax) printers made by Hewlett Packard.

Since the flaws discovered by F-Secure security researchers Alexander Bolshev and Timo Hirvonen date back to at least 2013, they've likely exposed a large number of users to cyberattacks for a notable amount of time.
HP has released fixes for the vulnerabilities in the form of firmware updates for two of the most critical flaws on November 1, 2021.
Click to expand...

These are CVE-2021-39237 and CVE-2021-39238. For a complete list of the affected products, click on the tracking numbers for the corresponding advisories.

The first one concerns two exposed physical ports that grant full access to the device. Exploiting it requires physical access and could lead to potential information disclosure.

The second one is a buffer overflow vulnerability on the font parser, which is a lot more severe, having a CVSS score of 9.3. Exploiting it gives threat actors a way to remote code execution.
CVE-2021-39238 is also "wormable," meaning a threat actor could quickly spread from a single printer to an entire network.
Click to expand...

F-Secure: F-Secure discovers vulnerabilities affecting over 150 HP printer models

HP Inc. has issued patches that fix security vulnerabilities cyber security provider F-Secure discovered in over 150 of their multifunction printer (MFP) products. According to research published today by F-Secure, attackers can exploit the vulnerabilities to seize control of vulnerable devices, steal information, and further infiltrate networks to inflict other types of damage.

F-Secure security consultants Timo Hirvonen and Alexander Bolshev discovered exposed physical access port vulnerabilities (CVE-2021-39237) and font parsing vulnerabilities (CVE-2021-39238) in HP’s MFP M725z – part of HP’s FutureSmart line of printers. Security advisories published by HP list over 150 different products affected by the vulnerabilities.
Click to expand...

A detailed technical write-up of the research is available on F-Secure Labs: https://labs.f-secure.com/publications/printing-shellz.
Click to expand...

Log in or Sign up

Printing Shellz – 8-year-old HP printer vulnerability affects 150 printer models

guest Guest

Log in or Sign up

Printing Shellz – 8-year-old HP printer vulnerability affects 150 printer models

guest Guest

Useful Searches