EUVD-2026-31475
GHSA-wghp-f8qf-wg62
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Adjacent vector matches description; pure availability DoS requiring physical restart warrants A:H; no confidentiality or integrity impact applies.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated remote attacker on the same network can establish a persistent connection to port 9100 and send keep-alive packets, causing the printer's session threads to remain locked in a waiting state. The firmware lacks connection timeouts and concurrent session limits, resulting in a persistent Denial of Service (DoS) that renders the printer unresponsive to all user commands and print jobs. Physical intervention (manual restart) is required to restore functionality, and the attack can be immediately re-initiated.
AnalysisAI
Port 9100 thread exhaustion in HP ENVY 5000 series printers (firmware VERBASPP1N003.2237A.00) enables an unauthenticated attacker on the same network segment to permanently render the device unresponsive by holding TCP connections open with keep-alive packets. The firmware's complete absence of connection timeouts and concurrent session limits means all JetDirect session threads become permanently locked, requiring physical power cycling to recover - and the attack is trivially re-launched immediately after restart. No public exploit code has been identified and SSVC assigns exploitation as none, but a public researcher write-up exists on Medium, and the persistent, unrecoverable nature of the DoS makes real-world impact disproportionate to the moderate CVSS score.
Technical ContextAI
HP ENVY 5000 series printers expose TCP port 9100 for raw/JetDirect printing, a protocol that accepts unframed print data streams from network clients. The affected firmware version VERBASPP1N003.2237A.00 implements a session-thread model to handle concurrent print connections but fails to enforce any upper bound on held sessions or apply idle/keepalive timeouts - a classic CWE-770 (Allocation of Resources Without Limits or Throttling) root cause. By keeping a TCP connection alive with periodic keep-alive packets, an attacker prevents the thread from being released back to the pool. Because the firmware has no eviction or timeout mechanism, the thread pool is eventually exhausted and the printer ceases to process any commands or print jobs. The CPE data in the NVD submission is recorded as n/a, meaning HP has not published formal CPE strings for this firmware, limiting automated scanner detection.
RemediationAI
No vendor-released patch or HP security advisory has been identified at time of analysis. The primary compensating control is network segmentation: restrict access to TCP port 9100 on affected printers to only authorized print servers or client subnets using a firewall or VLAN policy, preventing arbitrary adjacent-network hosts from reaching the JetDirect port. Trade-off: this blocks legitimate printing from unauthorized subnets, so access control lists must reflect the actual print environment. A secondary control is deploying TCP connection rate limiting or idle session timeouts at the network perimeter (e.g., via stateful firewall rules dropping TCP sessions idle for more than 60 seconds on port 9100), which may reduce the attacker's ability to hold threads indefinitely without disrupting legitimate print jobs. Operators should monitor for firmware updates from HP at https://support.hp.com and subscribe to HP security bulletins. The researcher disclosure is available at https://jacobmasse.medium.com/hp-envy-5000-printer-dos-vulnerability-8cae52c87b41 for additional technical context.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today