Hewlett Packard (HP) printers store sensitive administrative account information in a variable that is served to any user that makes a certain SNMP request.
HP JetDirect-enabled printers are configurable via HTTP and Telnet and accept SNMP requests. These printers store the administrative account password in an SNMP variable that can be read by any remote user that knows the address of the printer and the location of the variable. The location of the variable is unchanging.
Attackers can obtain sensitive information and gain unauthorized access to the printer.
Apply a patch
Update to firmware version X.22.09 or later.
Thanks to Phenoelit for reporting this vulnerability.
This document was written by Shawn Van Ittersum.
|Date First Published:||2002-09-16|
|Date Last Updated:||2004-02-23 22:24 UTC|