What is the CVSS score of CVE-2024-51982?

CVE-2024-51982 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of HP are affected by CVE-2024-51982?

This vulnerability allows unauthenticated attackers to remotely crash networked printers by exploiting a flaw in Printer Job Language processing, causing repeated denial of service.

How to fix or mitigate CVE-2024-51982?

Within 24 hours: Identify and inventory all affected printers connected to your network; restrict network access to TCP port 9100 to authorized users only via firewall rules. Within 7 days: Isolate vulnerable printers to a segregated network segment or VLAN if critical patches cannot be applied; monitor for suspicious PJL commands and unusual printer restart patterns. Within 30 days: Contact the vendor for patch availability and timeline; implement a patching schedule once available; consider replacing or retiring devices if patches are not forthcoming.

HP CVE-2024-51982

EUVD-2024-54702 HIGH

Improper Validation of Syntactic Correctness of Input (CWE-1286)

2025-06-25 cve@rapid7.com

Denial Of Service HP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2024-54702

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 08:15 nvd

HIGH 7.5

DescriptionCVE.org

An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device. A malformed PJL variable FORMLINES is set to a non number value causing the target to crash.

AnalysisAI

CVE-2024-51982 is a denial-of-service vulnerability affecting network-connected printers and multifunction devices that expose the Printer Job Language (PJL) interface on TCP port 9100. An unauthenticated remote attacker can send a malformed PJL command with an invalid FORMLINES variable to crash the device repeatedly, causing service disruption without authentication or user interaction. The CVSS 7.5 score reflects the high availability impact, and while specific KEV/POC data was not provided in the source material, the straightforward nature of the exploit (malformed input causing crash) suggests practical exploitability.

Technical ContextAI

The vulnerability exists in the Printer Job Language (PJL) command interpreter—a standard protocol used by HP and compatible printers for job control and device configuration. PJL operates over raw TCP port 9100 (Line Printer Daemon protocol) and traditionally lacks authentication mechanisms. The root cause falls under CWE-1286 (Improper Validation of Syntactic Correctness of Input), specifically the failure to properly validate that the FORMLINES variable contains a numeric value before processing it. When the printer firmware attempts to parse a non-numeric string assigned to FORMLINES, it triggers an unhandled exception or buffer overflow condition, causing the device to crash and reboot. This is a classic case of insufficient input validation in embedded printer firmware where the PJL parser does not enforce type constraints on configuration variables.

RemediationAI

Recommended remediation steps: (1) IMMEDIATE MITIGATION: Restrict network access to TCP port 9100 using firewall rules; disable external routing to printer subnets; implement network segmentation (VLAN isolation) to prevent untrusted hosts from reaching printers; (2) PATCH DEPLOYMENT: Identify affected printer models and apply available firmware updates from the manufacturer—consult HP, Xerox, Canon, Ricoh, or Kyocera security advisories for specific patch versions and download links; (3) DEVICE HARDENING: Disable PJL if not required; if PJL is necessary, restrict it to trusted IP ranges using printer access control lists (ACLs); (4) MONITORING: Enable printer syslog/SNMP alerts to detect repeated crash/reboot sequences indicative of exploitation attempts; (5) ALTERNATIVE: Replace devices with firmware that cannot be exploited once patches are validated and tested in a lab environment. Vendors typically release firmware patches through security bulletins; check HP Security Advisory, Xerox Support, Canon ImageRunner documentation, and Ricoh Device Gateway for specific patch versions.