Vulnerability Note VU#717921
Hewlett-Packard printers and scanner devices allow remote unautheticated firmware updates
A vulnerability in certain Hewlett-Packard devices could allow a remote attacker to install unauthorized firmware on an affected system.
Certain Hewlett-Packard Printers and Hewlett-Packard Digital Senders products allow the device's firmware to be updated over the network. The firmware update process can be accomplished via port 9100/tcp and does not require authentication. As a result, a remote attacker could perform unauthorized modification of the device's firmware.
Hewlett-Packard notes that the remote firmware update feature is enabled by default on affected systems. The list of affected devices can be found in HP Security Bulletin HPSBPI02728 SSRT100692, and includes many varieties of the HP LaserJet and Color LaserJet products.
A remote unauthenticated attacker could install malicious firmware on an affected device. This malicious firmware could allow the attacker to take control of the affected device, gain access to sensitive information sent to or from the device, or cause a denial of service (e.g., through malfunction of the device).
Disable Remote Firmware Update
Vendor Information (Learn More)
|Vendor||Status||Date Notified||Date Updated|
|Hewlett-Packard Company||Affected||-||08 Dec 2011|
CVSS Metrics (Learn More)
This document was written by Chad Dougherty.
- CVE IDs: CVE-2011-4161
- Date Public: 29 Nov 2011
- Date First Published: 08 Dec 2011
- Date Last Updated: 02 Dec 2013
- Document Revision: 11
If you have feedback, comments, or additional information about this vulnerability, please send us email.