What is the CVSS score of CVE-2024-2209?

CVE-2024-2209 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L. EPSS exploitation probability: 0.2%.

26K70B Firmware CVE-2024-2209

MEDIUM

Code Injection (CWE-94)

2024-03-27 hp-security-alert@hp.com

Code Injection HP RCE Microsoft 26K70B Firmware 297X1A Firmware 2A9Q5A Firmware 26K72A Firmware 26K69A Firmware 26K70A Firmware 26K71A Firmware 26K68A Firmware 26K67A Firmware 3Xv19A Firmware 7Fr52A Firmware 7Fr57A Firmware 7Fr53A Firmware 7Fr58A Firmware 7Fr61A Firmware 5Ar83A Firmware 5Ar84A Firmware 5Ar85A Firmware 8Rk11A Firmware 3Xv17A Firmware 4Ws04A Firmware 7Fr21A Firmware 7Fr20A Firmware 26K72B Firmware 26K67B Firmware 297W8A Firmware 26K68B Firmware 297X0A Firmware

6.3

CVSS 3.1 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

6.3 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Primary rating from Vendor (hp) · only source for this CVE.

CVSS VectorVendor: hp

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

CVE Published

Mar 27, 2024 - 00:15 cve.org

MEDIUM 6.3

DescriptionCVE.org

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

AnalysisAI

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft. Rated medium severity (CVSS 6.3), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Code Injection (CWE-94), which allows attackers to inject and execute arbitrary code within the application. A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution. Affected products include: Hp 26K70B Firmware, Hp 297X1A Firmware, Hp 2A9Q5A Firmware, Hp 26K72A Firmware, Hp 26K69A Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Never evaluate user-controlled input as code. Use sandboxing, disable dangerous functions, apply strict input validation.