What is the CVSS score of CVE-2024-51978?

CVE-2024-51978 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 48.3%.

Which versions of HP are affected by CVE-2024-51978?

A critical vulnerability in networked printing devices allows unauthenticated attackers to gain full administrative access by deriving default passwords from publicly discoverable serial numbers.

Is there a public PoC exploit available for CVE-2024-51978?

Yes, a public proof-of-concept exploit is available for CVE-2024-51978. Prioritise patching immediately. EPSS: 48.3%.

How to fix or mitigate CVE-2024-51978?

Within 24 hours: Inventory all affected printer models and isolate critical devices to segmented networks if possible; disable remote access protocols (HTTP/HTTPS/IPP/SNMP) where feasible. Within 7 days: Implement network-level controls (firewall rules, WAF policies) to restrict unauthenticated access to printer management interfaces and change all default credentials manually via secure, local access only. Within 30 days: Monitor vendor communications for patch availability; develop printer hardening baseline; conduct audit of print device access logs for unauthorized login attempts.

HP CVE-2024-51978

EUVD-2024-54698 CRITICAL

Use of Weak Credentials (CWE-1391)

2025-06-25 cve@rapid7.com

Authentication Bypass Information Disclosure HP

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2024-54698

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

PoC Detected

Jul 25, 2025 - 17:15 vuln.today

Public exploit code

CVE Published

Jun 25, 2025 - 08:15 nvd

CRITICAL 9.8

DescriptionNVD

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

AnalysisAI

Certain devices expose serial numbers via HTTP/HTTPS/IPP and SNMP that can be used to generate the default administrator password. An unauthenticated attacker who discovers the serial number can calculate the admin password and gain full administrative control of the device without brute force.

Technical ContextAI

The device generates its default administrator password using an algorithm based on the serial number. The serial number is exposed through multiple protocols (HTTP, HTTPS, IPP, PJL, SNMP) without authentication. An attacker can chain CVE-2024-51977 (serial number disclosure) with this vulnerability to generate the admin password remotely.

RemediationAI

Change the default administrator password immediately. Restrict SNMP and management interface access. Disable information disclosure endpoints. Implement network segmentation for IoT/printer devices.