54 HP Printer Models for Enterprises Remotely Vulnerable to Attackers
These are printers running Windows CE as their OS. The vulnerability allows someone to read the contents of the FIPS-encrypted hard drive. The vulnerability is achieved through a malicious software update, but these printers can even have their firmware installed via a print job running over port 9100.
This affects a number HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP OffifceJet Enterprise printers.
The report is at http://ift.tt/2zmhbGJ and describes how it works. HP is busy issuing a patch for this but it is worth checking that all printers are patched as many enterprises are slower at patching printers than desktop computers and servers.
Note that the remote code execution vulnerability described in this post was reported to HP on August 21st, 2017. HP says that a fix has been developed and has published a security bulletin http://ift.tt/2B3czSf.
from Danie van der Merwe - Google+ Posts http://ift.tt/2kdXzhi
via IFTTT
These are printers running Windows CE as their OS. The vulnerability allows someone to read the contents of the FIPS-encrypted hard drive. The vulnerability is achieved through a malicious software update, but these printers can even have their firmware installed via a print job running over port 9100.
This affects a number HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP OffifceJet Enterprise printers.
The report is at http://ift.tt/2zmhbGJ and describes how it works. HP is busy issuing a patch for this but it is worth checking that all printers are patched as many enterprises are slower at patching printers than desktop computers and servers.
Note that the remote code execution vulnerability described in this post was reported to HP on August 21st, 2017. HP says that a fix has been developed and has published a security bulletin http://ift.tt/2B3czSf.
 |
A Sheep in Wolf’s Clothing – Finding RCE in HP’s Printer Fleet By @breenmachine Sometimes the marketing department goes a little too far. Most of us who work in security have been there, non-technical people enthusiastic about selling the technical feat… |
from Danie van der Merwe - Google+ Posts http://ift.tt/2kdXzhi
via IFTTT
Comments