EUVD-2026-42442
GHSA-wj85-38pj-pr6j
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AT:P (prior cookie theft prerequisite) maps to AC:H in 3.1; PR:L retained for authenticated session requirement; UI:R reflects passive interaction; S:U as no scope change observed.
Primary rating from Vendor (hp).
CVSS VectorVendor: hp
Lifecycle Timeline
2DescriptionCVE.org
Malicious use of a stolen cookie might allow modifications to the contents of the IP phone’s webpage.
AnalysisAI
Cross-Site Request Forgery in HP IP phones' web management interface allows an attacker who has obtained a stolen session cookie to submit unauthorized state-changing requests that modify the phone's webpage contents, with integrity and availability rated high (VI:H/VA:H) in the vendor-supplied CVSS 4.0 vector. The CVSS 4.0 score of 6.0 reflects the attack conditions prerequisite (AT:P) of prior cookie theft, low-level privilege requirement (PR:L), and passive user interaction (UI:P), meaningfully limiting opportunistic exploitation. No public exploit code exists and this vulnerability has not been added to the CISA KEV catalog at time of analysis.
Technical ContextAI
CWE-352 identifies this as a Classic Cross-Site Request Forgery flaw in the HTTP-based web management interface embedded in HP IP phones. CSRF vulnerabilities arise when a web application fails to distinguish legitimate, user-initiated state-changing requests from forged requests submitted by a third party reusing a captured session credential. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:P) confirms the interface is network-accessible, and the AT:P (Attack Requirements Present) metric directly encodes the prerequisite that a valid session cookie must first be stolen before the forged request can succeed. The SC:N/SI:N/SA:N values indicate no scope change beyond the vulnerable phone itself. Exact affected firmware versions and phone model CPEs are not enumerated in the available CVE data and must be obtained from HP Security Bulletin hpsbpy04109.
RemediationAI
Consult HP Security Bulletin hpsbpy04109 (https://support.hp.com/us-en/document/ish_15255241-15255270-16/hpsbpy04109) for the authoritative patch release, affected model list, and exact fixed firmware versions - no specific patch version is independently confirmed from available CVE data. As compensating controls, network-segment the phone's web management interface using firewall rules to block all inbound HTTP and HTTPS traffic to the management port from untrusted networks, which eliminates network reachability without affecting core call functionality. Enforce HTTPS-only access to prevent session cookie interception in transit; the trade-off is that this requires a valid certificate to be deployed on the device. If remote web administration is not required, disabling the phone's web management interface entirely removes the attack surface entirely, though it prevents legitimate remote configuration. Ensure session cookies are configured with the Secure and HttpOnly attributes where the firmware permits, reducing the window for cookie theft.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today