HP
Monthly
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
An out-of-bounds read in the Linux kernel's hp-bioscfg platform driver lets a malformed PSWD_ENCODINGS ACPI package cause the parser to read past the end of the ACPI object array and hand an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(), resulting in kernel-memory disclosure or a kernel crash (the assessed vector is AV:L/AC:H/PR:H with high availability impact and limited confidentiality impact). Only systems running the hp-bioscfg driver - i.e. HP hardware whose firmware exposes the BIOS-configuration WMI/ACPI interface - are affected, and exploitation requires the attacker to control or modify the platform ACPI tables, since the index bound is only violated when firmware declares a non-zero encoding count without supplying enough string objects. The vendor-published CVSS of 7.7 depicts an unauthenticated, low-complexity local attacker, but this assessment rates the realistic path as higher-complexity and privileged because it depends on attacker-influenced firmware data; no public exploit code and no confirmed active exploitation were identified at time of analysis.
HP Advance server software contains a path traversal vulnerability (CWE-22) in its HP AC Print & Scan and HP Output Central components, allowing unauthenticated remote attackers to write arbitrary files, which can lead to remote code execution or privilege escalation. The vendor CVSS 4.0 vector (8.8) rates it network-reachable and unauthenticated with high integrity and availability impact, but HP notes impact occurs 'under certain conditions,' implying unstated deployment prerequisites that may narrow actual exploitability; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-management server hosting HP AC Print & Scan or HP Output Central achieve elevation of privilege, remote code execution, or arbitrary file write, as described in HP's self-published advisory hpsbpi04149 (CVSS 4.0 base score 9.3 Critical, CWE-94). The vendor scores both the vulnerable component (VC:H/VI:L) and subsequent systems (SC:H/SI:H) as impacted, and our independent assessment retains a high-severity rating (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) while noting that HP's explicit 'under certain conditions' wording implies a specific feature, endpoint, or deployment mode is a likely precondition despite the AC:L rating. Exploitation requires no authentication and no user interaction per the CVSS vector, but there is no CISA KEV entry, no public exploit code identified at time of analysis, and no affected version range published by the vendor.
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. No public exploit code has been identified at time of analysis, though the vendor's CVSS 4.0 vector rates it 9.3 critical while an independent assessment adjusts attack complexity to High due to the gating conditions.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.
Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitrary operating-system commands with the privileges of the affected HPLIP component, resulting in high confidentiality, integrity, and availability impact (vendor CVSS 4.0 base 8.4) and spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. Exploitation is not remote: it requires local access to a Linux host that has HPLIP installed and in use, and it requires active user interaction, typically by inducing a legitimate user to feed attacker-controlled input into a vulnerable HPLIP component that builds an OS command (CWE-78). No authentication or elevated privileges are needed (PR:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; HP has released remediation for the affected components in advisory HPSBPI04151.
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.
Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes attacker-influenced input such as a crafted print job, a malicious device or network response, or a handled file, with the affected product confirmed by HP and documented in advisory HPSBPI04151. No authentication is required to reach the vulnerable components, but exploitation depends on mandatory user interaction and on hosts that actually have HPLIP installed and in active printing or scanning use. Worst-case impact spans remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification; no public exploit code or confirmed active exploitation was identified at time of analysis.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues.
Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Information disclosure in HP Deskjet 2800 Series printers running firmware TBP1CN2612AR or earlier lets an unauthenticated attacker on the network read sensitive configuration - including plaintext Wi‑Fi Direct credentials, device identity, and administrative security state - by sending plain GET requests to administrative API endpoints. The same data is gated behind administrator login in the web UI, so these API endpoints bypass the product's own access-control model. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter across Red Hat Enterprise Linux 6 through 10, where an integer overflow triggered by specially crafted print data can corrupt memory. This is an incomplete-fix follow-up to CVE-2026-8631, meaning the original patch did not fully close the flaw, and no public exploit has been identified at time of analysis. The Red Hat CVSS of 9.8 reflects a network-reachable, unauthenticated attack path, though realistic exploitation depends on how the CUPS print pipeline is exposed.
Denial of service in HP Poly Voice IP endpoints (CCX, Trio C60, and Edge E series) allows an attacker operating or impersonating a SIP server to render affected devices inoperable by returning malformed data during SIP signaling. The flaw is an uncontrolled-resource-consumption / improper-input-handling issue (CWE-400) that crashes or hangs the phone, disrupting voice service. HP has published advisory hpsbpy04096 and is releasing firmware updates; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation and arbitrary code execution in the HP Accessory WMI Provider installer bundled with certain HP Docking Stations allows a low-privileged local user to gain elevated (likely SYSTEM) execution. The root cause is insecure temporary-file/directory permissions used during installation (CWE-379), which an attacker can abuse to introduce or replace executable content that a privileged installer process runs. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; HP has published advisory hpsbhf04129 and is releasing software updates.
Local privilege escalation and denial of service in HP One Agent software on HP PC products allow authenticated low-privileged users to gain elevated rights or disrupt the agent. HP has acknowledged the issue and is releasing software updates as mitigation. No public exploit identified at time of analysis, and the flaw is not listed on CISA KEV.
Local privilege escalation in HP Linux Imaging and Printing Software (HPLIP) allows authenticated low-privileged users to execute arbitrary OS commands via command injection, potentially gaining elevated privileges on affected Linux hosts. The CVSS 4.0 score of 8.5 reflects high impact to confidentiality, integrity, and availability with low attack complexity, and no public exploit identified at time of analysis. The vulnerability is reported directly by HP PSIRT under advisory hpsbpi04118.
Heap-based integer overflow in the hpcups component of HP Linux Imaging and Printing Software (HPLIP) allows attackers to achieve arbitrary code execution and/or privilege escalation by submitting crafted print data. The CVSS 4.0 base score of 9.3 reflects network-reachable exploitation against the printing subsystem with no authentication or user interaction required, though no public exploit identified at time of analysis and the issue has not been added to CISA KEV.
Remote code execution in HP DeskJet All-in-One printers via malformed WSD scan requests allows adjacent network attackers to fully compromise the device. A stack-based buffer overflow (CWE-121) in the MFP's processing of Web Services for Devices (WSD) scan jobs enables unauthenticated arbitrary code execution. No active exploitation or public proof-of-concept has been reported, and EPSS predicts low exploitation likelihood.
Local privilege escalation in HP Omen Gaming Hub versions prior to 1101.2603 allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges. A public proof-of-concept detection template exists, but no active exploitation has been reported. The vulnerability is rated High severity with an EPSS of 0.01%, indicating low near-term exploitation probability.
HP System Event Utility versions prior to 3.2.16 allow local authenticated users to corrupt system integrity and cause denial of service through arbitrary file writes with elevated privileges. An attacker with local access and valid credentials can leverage this vulnerability to modify critical files and disrupt system availability. No patch is currently available for affected installations.
A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary code execution vulnerability affecting multiple Micro Focus products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.7%.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors. Rated medium severity (CVSS 4.4). Public exploit code available and EPSS exploitation probability 12.2%.
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 89.8%.
Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.1%.
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.3%.
The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.8%.
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.0%.
Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.1%.
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.5%.
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.0%.
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.8%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 71.4%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.2%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1510. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 46.3%.
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1680. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to execute arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.4%.
Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.6%.
Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.6%.
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter. Rated high severity (CVSS 7.7), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 44.8%.
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
A kernel-mode heap buffer overflow (CWE-122) in HP Sure Click and the related HP Wolf Security product family at versions below 4.4.33 allows a local attacker who already holds elevated privileges to corrupt kernel memory and potentially escalate to full system-level code execution. The flaw is reachable only from a local context on a Windows host running the affected endpoint security agent, requires a non-trivial triggering condition such as precise heap state or a memory-corruption race, and exposes no network or remote attack path. HP has released version 4.4.33 as the vendor-released fix, and no public exploit code has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by freeing the old string and installing a new one: if (strcmp(trimmed, nsensor->current_state)) { new_string = hp_wmi_strdup(dev, trimmed); if (new_string) { devm_kfree(dev, nsensor->current_state); nsensor->current_state = new_string; } } This function is only ever called from hp_wmi_update_info() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates. fungible_show(), however, reads the same pointer after the lock has already been dropped: err = hp_wmi_update_info(state, info); if (err) return err; switch (prop) { ... case HP_WMI_PROPERTY_CURRENT_STATE: seq_printf(seqf, "%s\n", nsensor->current_state); break; hp_wmi_update_info() takes state->lock internally and releases it before returning, so by the time fungible_show() dereferences nsensor->current_state in seq_printf(), no lock is held. Two processes reading a sensor's current_state debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seq_printf() can be part-way through printing the string at the moment another thread's call into update_numeric_sensor_from_wobj() frees it with devm_kfree() and installs a new pointer, causing a use-after-free read. Take state->lock around the read in fungible_show() as well, so it can never run concurrently with the free-and-replace in update_numeric_sensor_from_wobj().
Improper validation of integrity check values in HP ThinPro thin-client OS images allows an attacker who already has physical access to a device to supply tampered data that the system fails to verify, resulting in high confidentiality and integrity impact (CVSS:3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; vendor CVSS 4.0 base 6.8). Organizations are affected if they run HP ThinPro 8.1 prior to Service Pack 10 or HP ThinPro 9 prior to Service Pack 3, typically on kiosks, lobbies, and shared VDI endpoints where physical access is loosely controlled. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the realistic risk is moderate and tightly constrained by the mandatory physical-access prerequisite rather than by remote exposure.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if (buf[length - 1] == '\n') length--; bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL); but then pass the original "count" (not "length") as the copy size to hp_wmi_perform_query(), which memcpy()s that many bytes out of the "length"-sized allocation, reading one byte past it whenever the write ends in a newline, the normal case for a shell "echo" into sysfs. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg] Read of size 28 at addr ffff88813c8e2b80 by task python3/16022 ... sk_store+0xa7/0x240 [hp_bioscfg] kernfs_fop_write_iter+0x3e1/0x5d0 ... The buggy address is located 0 bytes inside of allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b) Reproduced identically for kek_store, and at multiple write sizes (28, 57, 201 bytes), each time reading exactly one byte past a kmemdup() allocation one byte smaller than the write. Fix by passing "length" instead of "count" to hp_wmi_perform_query() in both functions.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline, without checking that length is nonzero first. Writing an empty string (a bare '\n') to current_password or new_password gives length == 0, and buf[length - 1] reads buf[-1], one byte before the heap allocation holding the copied input. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] Read of size 1 at addr ffff88811bd8da9f by task sh/13740 ... store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] current_password_store+0x14/0x20 [hp_bioscfg] ... The buggy address is located 23 bytes to the right of allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88) Reproduced identically via new_password_store. Execution continues past the bad read (the garbage byte only affects whether "length" is decremented by one), so the write completes and returns success; this is a pure information read past the buffer, not a crash, but it is still an out-of-bounds access KASAN correctly flags. Fix by only checking buf[length - 1] when length is nonzero.
Uncontrolled resource consumption in HP Smart Tank All-in-One printers allows unauthenticated network attackers to render affected devices unavailable by flooding them with concurrent HTTP requests. The vulnerability (CWE-400) is rooted in the printer's embedded HTTP service failing to throttle or bound incoming connection load, causing availability loss without any authentication requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, though the simplicity of the attack vector (parallel HTTP flooding) significantly lowers the skill bar for exploitation.
Cross-site scripting in HP DesignJet large-format printers allows adjacent-network unauthenticated attackers to inject malicious scripts via crafted HTTP requests that execute when a user views print job previews through the device's embedded web interface. The CVSS 4.0 vector (AV:A/VI:H) constrains the attack to local network adjacency while indicating high integrity impact - consistent with an attacker manipulating displayed print job content or forging actions within the printer's management UI. No public exploit has been identified at time of analysis, and HP has self-disclosed the issue.
Out-of-bounds heap write in Erlang OTP's binary_to_term/1 function causes virtual machine crash via a maliciously crafted Erlang external term format (ETF) binary. The vulnerability, triggered by a signed/unsigned conversion error in LARGE_TUPLE_EXT decoding, affects OTP 25.0 through 27.3.4.14, 28.5.0.3, and 29.0.3. No authentication is required, and exploitation leads to denial of service; no public exploit code has been identified at time of analysis.
Port 9100 thread exhaustion in HP ENVY 5000 series printers (firmware VERBASPP1N003.2237A.00) enables an unauthenticated attacker on the same network segment to permanently render the device unresponsive by holding TCP connections open with keep-alive packets. The firmware's complete absence of connection timeouts and concurrent session limits means all JetDirect session threads become permanently locked, requiring physical power cycling to recover - and the attack is trivially re-launched immediately after restart. No public exploit code has been identified and SSVC assigns exploitation as none, but a public researcher write-up exists on Medium, and the persistent, unrecoverable nature of the DoS makes real-world impact disproportionate to the moderate CVSS score.
Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.
Race condition in PaperCut MF badge-swipe processing from HP multifunction devices allows unauthorized user login when custom badge-ID post-processing scripts transform truncated badge strings into valid credentials of different users. The vulnerability requires specific network conditions (dropped packets, out-of-order sequence counters, failed sequence reset notifications) and custom script configuration, affecting physical device authentication in networked printing environments. No public exploit identified at time of analysis.
Stored XSS in the Hammas Calendar WordPress plugin through version 1.5.11 allows authenticated contributors and above to inject malicious scripts via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode due to inadequate input sanitization. When users access pages containing the injected payload, the scripts execute in their browsers, potentially leading to session hijacking, credential theft, or malware distribution. No patch is currently available.
The HP BIOS configuration driver in the Linux kernel fails to validate attribute names before kobject registration, causing kernel warnings and potential denial of service when HP BIOS returns empty name strings. A local user with standard privileges can trigger this vulnerability to crash or destabilize the system by supplying malformed BIOS attribute data. No patch is currently available for this medium-severity flaw affecting Linux systems with HP BIOS configuration support.
HP OfficeJet Pro printers (D9l18a, D9l20a, D9l21a, D9l63a firmware) are vulnerable to information disclosure through CORS misconfiguration when administrators enable the feature on the Embedded Web Server. An unauthenticated remote attacker can exploit this to access sensitive device resources from untrusted web origins. CORS remains disabled by default as a mitigation, but organizations that have explicitly enabled it should apply patches when available.
HP OfficeJet Pro printers running affected firmware versions are susceptible to denial of service attacks through malformed Internet Printing Protocol (IPP) requests that prevent proper TCP connection establishment. An unauthenticated remote attacker can trigger this condition to disrupt printer availability, though no patch is currently available to mitigate the vulnerability.
In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used e.g. in HP 730 workstations.
router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor is affected by information exposure (CVSS 7.5).
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities.
Sensitive configuration data can be written into a local log file on HP Poly VideoOS and Poly TCOS endpoints when an administrator changes device settings through the Microsoft Teams Admin Center (TAC) interface. The exposure is narrow by design: the affected log is readable only by users holding administrator credentials, and the flaw does not trigger when the same configuration changes are made through the provisioning server or the device WebUI. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the CVSS 8.1 base score overstates operational risk - the prerequisite of administrator-level access to the log sharply constrains who could actually read the leaked data, consistent with our independent assessment of a modest-priority information-disclosure issue.
Local privilege escalation in HP Support Assistant versions prior to 9.55.10.0 allows an authenticated local attacker to gain elevated privileges on affected Windows hosts through insufficient access controls (CWE-269, improper privilege management). The flaw is not remotely reachable and requires the attacker to already hold low-privileged local access plus satisfaction of a specific attack precondition (expressly flagged as AT:P in the CVSS 4.0 vector), which constrains reliable exploitation; no public exploit code and no confirmed active exploitation were identified at time of analysis. Impact is rated high for confidentiality, integrity and availability of the affected host, making patched builds (9.55.10.0 and later) the primary mitigation.
An out-of-bounds read in the Linux kernel's hp-bioscfg platform driver lets a malformed PSWD_ENCODINGS ACPI package cause the parser to read past the end of the ACPI object array and hand an out-of-bounds string pointer and length to hp_convert_hexstr_to_str(), resulting in kernel-memory disclosure or a kernel crash (the assessed vector is AV:L/AC:H/PR:H with high availability impact and limited confidentiality impact). Only systems running the hp-bioscfg driver - i.e. HP hardware whose firmware exposes the BIOS-configuration WMI/ACPI interface - are affected, and exploitation requires the attacker to control or modify the platform ACPI tables, since the index bound is only violated when firmware declares a non-zero encoding count without supplying enough string objects. The vendor-published CVSS of 7.7 depicts an unauthenticated, low-complexity local attacker, but this assessment rates the realistic path as higher-complexity and privileged because it depends on attacker-influenced firmware data; no public exploit code and no confirmed active exploitation were identified at time of analysis.
HP Advance server software contains a path traversal vulnerability (CWE-22) in its HP AC Print & Scan and HP Output Central components, allowing unauthenticated remote attackers to write arbitrary files, which can lead to remote code execution or privilege escalation. The vendor CVSS 4.0 vector (8.8) rates it network-reachable and unauthenticated with high integrity and availability impact, but HP notes impact occurs 'under certain conditions,' implying unstated deployment prerequisites that may narrow actual exploitability; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-management server hosting HP AC Print & Scan or HP Output Central achieve elevation of privilege, remote code execution, or arbitrary file write, as described in HP's self-published advisory hpsbpi04149 (CVSS 4.0 base score 9.3 Critical, CWE-94). The vendor scores both the vulnerable component (VC:H/VI:L) and subsequent systems (SC:H/SI:H) as impacted, and our independent assessment retains a high-severity rating (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) while noting that HP's explicit 'under certain conditions' wording implies a specific feature, endpoint, or deployment mode is a likely precondition despite the AC:L rating. Exploitation requires no authentication and no user interaction per the CVSS vector, but there is no CISA KEV entry, no public exploit code identified at time of analysis, and no affected version range published by the vendor.
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. No public exploit code has been identified at time of analysis, though the vendor's CVSS 4.0 vector rates it 9.3 critical while an independent assessment adjusts attack complexity to High due to the gating conditions.
Heap-based buffer overflow (CWE-122) in HP's HPLIP - the HP Linux Imaging and Printing Software stack shipped as the default printer/scanner driver on most Linux distributions - can be triggered when attacker-influenced data is processed by a vulnerable component, potentially leading to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. This is a bundled advisory covering multiple externally reported flaws across several HPLIP components, so the precise prerequisites vary per sub-vulnerability; the vendor assigns CVSS 4.0 score 9.3 (Critical) with a remote, unauthenticated, low-complexity vector, while the independent assessment is more conservative at CVSS 3.1 AV:N/AC:H/PR:N/UI:N, reflecting that the system must be running HPLIP and actually process malicious input. No public exploit code and no confirmed active exploitation were identified at time of analysis.
HPLIP (HP Linux Imaging and Printing Software) is affected by multiple heap-based buffer overflow vulnerabilities (CWE-122) that can lead to remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Exploitation requires user interaction, such as a victim performing a print or scan operation or processing attacker-supplied imaging data, but no authentication is needed, and the attack is network-reachable. HP has remediated the issues; no public exploit code has been identified at the time of analysis.
Heap-based buffer overflow and related memory-safety flaws in HP Linux Imaging and Printing (HPLIP) can allow remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification on Linux hosts where HPLIP is installed and the affected component is active. This is an aggregate HP bulletin (hpsbpi04151) that bundles multiple externally reported issues under one CVE, so the published CVSS 4.0 score of 9.3 (AV:N/AC:L/PR:N/UI:N/VC:H/VI:H/VA:H) represents the worst-case component rather than any single flaw, and the assessed CVSS 3.1 score is lower (AV:N/AC:H) because several sub-issues are more likely local than remote and heap exploitation requires reliable memory grooming. No public exploit code or confirmed active exploitation was identified at time of analysis, and the exposure is limited to Linux systems on which HPLIP is deployed rather than being a universal service.
Command injection weaknesses in HP Linux Imaging and Printing Software (HPLIP) allow a local attacker to execute arbitrary operating-system commands with the privileges of the affected HPLIP component, resulting in high confidentiality, integrity, and availability impact (vendor CVSS 4.0 base 8.4) and spanning remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification. Exploitation is not remote: it requires local access to a Linux host that has HPLIP installed and in use, and it requires active user interaction, typically by inducing a legitimate user to feed attacker-controlled input into a vulnerable HPLIP component that builds an OS command (CWE-78). No authentication or elevated privileges are needed (PR:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; HP has released remediation for the affected components in advisory HPSBPI04151.
Heap-based buffer overflows and related memory-safety flaws in HPLIP (HP Linux Imaging and Printing Software) let remote attackers corrupt memory in the print, scan, and device-discovery stack, potentially yielding remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification. Only Linux hosts with HPLIP installed and actively processing attacker-influenced input - a crafted print job, a rogue printer/scanner response, or a file handled by the HPLIP stack - are affected, and exploitation is gated on active user interaction (initiating or accepting the malicious print/scan operation) rather than being a fully autonomous remote exploit. The flaws are unauthenticated per the vendor CVSS vector (PR:N), impact varies depending on which bundled sub-vulnerability is triggered, and no public exploit identified at time of analysis.
Out-of-bounds write flaws in HPLIP (HP Linux Imaging and Printing Software) can corrupt memory when a user processes attacker-influenced input such as a crafted print job, a malicious device or network response, or a handled file, with the affected product confirmed by HP and documented in advisory HPSBPI04151. No authentication is required to reach the vulnerable components, but exploitation depends on mandatory user interaction and on hosts that actually have HPLIP installed and in active printing or scanning use. Worst-case impact spans remote code execution, privilege escalation, denial of service, information disclosure, and unauthorized file modification; no public exploit code or confirmed active exploitation was identified at time of analysis.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in HP Support Assistant (versions prior to 9.53.2.0) allows a low-privileged local user to gain elevated system privileges by exploiting insufficient granularity in access controls (CWE-1220). The vulnerability requires local authenticated access but no user interaction, and the CVSS 4.0 AT:P metric indicates specific attack conditions must be present. No public exploit code or active exploitation has been identified at time of analysis; HP has released a patched version addressing the issue.
Privilege escalation in HP ImageDiags prior to version 5.0.0.36 enables a local low-privileged attacker - contingent on active interaction by a higher-privileged user - to gain elevated system privileges through insufficient access controls on temporary file resources (CWE-379). All versions of HP ImageDiags before 5.0.0.36 are affected per HP security bulletin HPSBGN04143. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
HP Easy Start for macOS prior to version 2.16.7.260722 is affected by privilege escalation vulnerabilities rooted in CWE-319 (Cleartext Transmission of Sensitive Information), allowing an authenticated low-privilege attacker with network positioning to intercept sensitive data and gain elevated access on the affected macOS system. The CVSS 4.0 score of 7.7 reflects high impact across confidentiality, integrity, and availability, though the attack prerequisite modifier (AT:P) indicates specific conditions must be satisfied before exploitation succeeds. No public exploit code or active exploitation has been confirmed; HP has released a patched version addressing these issues.
Privilege escalation in HP Easy Start for macOS (versions prior to 2.16.7.260722) allows low-privileged local users to gain elevated system access through insecure temporary file handling, classified under CWE-379. HP has released version 2.16.7.260722 to address these vulnerabilities, as detailed in advisory HPSBPI04124. No public exploit code exists and no CISA KEV listing is present at time of analysis, reducing immediate urgency despite a vendor-assigned CVSS 4.0 score of 7.7.
Privilege escalation vulnerabilities in HP Easy Start for macOS, versions prior to 2.16.7.260722, allow a local low-privileged user to gain elevated system access. Classified under CWE-1104 (Use of Unmaintained Third-Party Components), the root cause likely involves outdated bundled libraries within the printer setup utility. HP has released version 2.16.7.260722 as the remediation; no public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read and write in HP Web Jetadmin (WJA) is achievable by unauthenticated remote actors via a DLL hijacking mechanism, carrying a CVSS 4.0 score of 8.9. The flaw exposes full confidentiality, integrity, and availability of the WJA host - an attacker can exfiltrate sensitive configuration and credential files or overwrite system files to achieve persistent access. Proof-of-concept exploit code exists (CVSS 4.0 E:P), elevating real-world risk, though active exploitation has not been confirmed by CISA KEV at time of analysis.
Information disclosure in HP Deskjet 2800 Series printers running firmware TBP1CN2612AR or earlier lets an unauthenticated attacker on the network read sensitive configuration - including plaintext Wi‑Fi Direct credentials, device identity, and administrative security state - by sending plain GET requests to administrative API endpoints. The same data is gated behind administrator login in the web UI, so these API endpoints bypass the product's own access-control model. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter across Red Hat Enterprise Linux 6 through 10, where an integer overflow triggered by specially crafted print data can corrupt memory. This is an incomplete-fix follow-up to CVE-2026-8631, meaning the original patch did not fully close the flaw, and no public exploit has been identified at time of analysis. The Red Hat CVSS of 9.8 reflects a network-reachable, unauthenticated attack path, though realistic exploitation depends on how the CUPS print pipeline is exposed.
Denial of service in HP Poly Voice IP endpoints (CCX, Trio C60, and Edge E series) allows an attacker operating or impersonating a SIP server to render affected devices inoperable by returning malformed data during SIP signaling. The flaw is an uncontrolled-resource-consumption / improper-input-handling issue (CWE-400) that crashes or hangs the phone, disrupting voice service. HP has published advisory hpsbpy04096 and is releasing firmware updates; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation and arbitrary code execution in the HP Accessory WMI Provider installer bundled with certain HP Docking Stations allows a low-privileged local user to gain elevated (likely SYSTEM) execution. The root cause is insecure temporary-file/directory permissions used during installation (CWE-379), which an attacker can abuse to introduce or replace executable content that a privileged installer process runs. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; HP has published advisory hpsbhf04129 and is releasing software updates.
Local privilege escalation and denial of service in HP One Agent software on HP PC products allow authenticated low-privileged users to gain elevated rights or disrupt the agent. HP has acknowledged the issue and is releasing software updates as mitigation. No public exploit identified at time of analysis, and the flaw is not listed on CISA KEV.
Local privilege escalation in HP Linux Imaging and Printing Software (HPLIP) allows authenticated low-privileged users to execute arbitrary OS commands via command injection, potentially gaining elevated privileges on affected Linux hosts. The CVSS 4.0 score of 8.5 reflects high impact to confidentiality, integrity, and availability with low attack complexity, and no public exploit identified at time of analysis. The vulnerability is reported directly by HP PSIRT under advisory hpsbpi04118.
Heap-based integer overflow in the hpcups component of HP Linux Imaging and Printing Software (HPLIP) allows attackers to achieve arbitrary code execution and/or privilege escalation by submitting crafted print data. The CVSS 4.0 base score of 9.3 reflects network-reachable exploitation against the printing subsystem with no authentication or user interaction required, though no public exploit identified at time of analysis and the issue has not been added to CISA KEV.
Remote code execution in HP DeskJet All-in-One printers via malformed WSD scan requests allows adjacent network attackers to fully compromise the device. A stack-based buffer overflow (CWE-121) in the MFP's processing of Web Services for Devices (WSD) scan jobs enables unauthenticated arbitrary code execution. No active exploitation or public proof-of-concept has been reported, and EPSS predicts low exploitation likelihood.
Local privilege escalation in HP Omen Gaming Hub versions prior to 1101.2603 allows a low-privileged local attacker to execute arbitrary code with SYSTEM privileges. A public proof-of-concept detection template exists, but no active exploitation has been reported. The vulnerability is rated High severity with an EPSS of 0.01%, indicating low near-term exploitation probability.
HP System Event Utility versions prior to 3.2.16 allow local authenticated users to corrupt system integrity and cause denial of service through arbitrary file writes with elevated privileges. An attacker with local access and valid credentials can leverage this vulnerability to modify critical files and disrupt system availability. No patch is currently available for affected installations.
A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Arbitrary code execution vulnerability affecting multiple Micro Focus products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 has incorrect exception handling and error-message generation during file-upload attempts, which allows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 92.7%.
Remote code execution in Adobe Flash Player allows network attackers to execute arbitrary code via integer overflow exploitation. Confirmed actively exploited (CISA KEV) with 88.97% EPSS score indicating extremely high real-world exploitation probability. Affects Flash Player before 18.0.0.324/20.0.0.267, Adobe AIR before 20.0.0.233, and associated SDKs across Windows, OS X, and Linux platforms. Vendor-released patches available since December 2015.
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in June 2015 by APT3 (a Chinese cyber espionage group) in phishing campaigns targeting aerospace and defense organizations.
Unspecified vulnerability in HP Network Node Manager i (NNMi) 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-2264. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.4%.
Unspecified vulnerability in HP Operations Agent 11.00, when Glance is used, allows local users to gain privileges via unknown vectors. Rated medium severity (CVSS 4.4). Public exploit code available and EPSS exploitation probability 12.2%.
Unspecified vulnerability in HP Storage Data Protector 8.x allows remote attackers to execute arbitrary code via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 89.8%.
Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 84.1%.
Unspecified vulnerability in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1905. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 77.3%.
The Backup Client Service (OmniInet.exe) in HP Storage Data Protector 6.2X allows remote attackers to execute arbitrary commands or cause a denial of service via a crafted EXEC_BAR packet to TCP port. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 76.8%.
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 78.0%.
Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.1%.
UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.5%.
UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.0%.
HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Multiple unspecified vulnerabilities in HP SiteScope 11.20 and 11.21, when SOAP is used, allow remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1678. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.8%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1735. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 71.4%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1705. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.2%.
Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.0%.
Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1510. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 46.3%.
Unspecified vulnerability in HP Storage Data Protector 6.20, 6.21, 7.00, and 7.01 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1680. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.2%.
Unspecified vulnerability in HP Intelligent Management Center (iMC) and Intelligent Management Center for Automated Network Manager (ANM) before 5.2 E0401 allows remote attackers to execute arbitrary. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 74.9%.
Stack-based buffer overflow in uam.exe in the User Access Manager (UAM) component in HP Intelligent Management Center (IMC) before 5.1 E0101P01 allows remote attackers to execute arbitrary code via. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.4%.
Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1463. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.6%.
Unspecified vulnerability in a SOAP feature in HP SiteScope 11.10 through 11.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1462. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 68.6%.
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter. Rated high severity (CVSS 7.7), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 44.8%.
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 82.3%.
Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 75.6%.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 73.7%.
A kernel-mode heap buffer overflow (CWE-122) in HP Sure Click and the related HP Wolf Security product family at versions below 4.4.33 allows a local attacker who already holds elevated privileges to corrupt kernel memory and potentially escalate to full system-level code execution. The flaw is reachable only from a local context on a Windows host running the affected endpoint security agent, requires a non-trivial triggering condition such as precise heap state or a memory-corruption race, and exposes no network or remote attack path. HP has released version 4.4.33 as the vendor-released fix, and no public exploit code has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: hwmon: (hp-wmi-sensors) Fix use-after-free in fungible_show() nsensor->current_state is dynamically replaced as the sensor's state changes. update_numeric_sensor_from_wobj() does this by freeing the old string and installing a new one: if (strcmp(trimmed, nsensor->current_state)) { new_string = hp_wmi_strdup(dev, trimmed); if (new_string) { devm_kfree(dev, nsensor->current_state); nsensor->current_state = new_string; } } This function is only ever called from hp_wmi_update_info() while state->lock is held, so the free-and-replace itself is properly serialized against concurrent updates. fungible_show(), however, reads the same pointer after the lock has already been dropped: err = hp_wmi_update_info(state, info); if (err) return err; switch (prop) { ... case HP_WMI_PROPERTY_CURRENT_STATE: seq_printf(seqf, "%s\n", nsensor->current_state); break; hp_wmi_update_info() takes state->lock internally and releases it before returning, so by the time fungible_show() dereferences nsensor->current_state in seq_printf(), no lock is held. Two processes reading a sensor's current_state debugfs entry at overlapping times (or one reading it while another read of the same sensor triggers a refresh) can race: one thread's seq_printf() can be part-way through printing the string at the moment another thread's call into update_numeric_sensor_from_wobj() frees it with devm_kfree() and installs a new pointer, causing a use-after-free read. Take state->lock around the read in fungible_show() as well, so it can never run concurrently with the free-and-replace in update_numeric_sensor_from_wobj().
Improper validation of integrity check values in HP ThinPro thin-client OS images allows an attacker who already has physical access to a device to supply tampered data that the system fails to verify, resulting in high confidentiality and integrity impact (CVSS:3.1 AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; vendor CVSS 4.0 base 6.8). Organizations are affected if they run HP ThinPro 8.1 prior to Service Pack 10 or HP ThinPro 9 prior to Service Pack 3, typically on kiosks, lobbies, and shared VDI endpoints where physical access is loosely controlled. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so the realistic risk is moderate and tightly constrained by the mandatory physical-access prerequisite rather than by remote exposure.
Denial of service in HP's HPLIP (HP Linux Imaging and Printing Software) printing stack is reachable when a physically-present attacker supplies specially crafted input that triggers a CWE-191 integer underflow, crashing or hanging affected components; the scored CVSS:3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) limits impact to availability only, with no confidentiality or integrity loss. The physical attack vector (direct hardware/USB or local physical access) is the dominant gating factor and rules out remote or network-based exploitation, and no public exploit has been identified at time of analysis. HP has stated that it identified and remediated the underlying issues, so a vendor fix is available per advisory hpsbpi04151, though the specific affected and fixed version ranges are not enumerated here and must be confirmed against that bulletin. Overall this is a genuine but low-priority issue: real availability impact, but exploitation requires an attacker to already have hands on the machine.
Denial of service in HP Linux Imaging and Printing Software (HPLIP) can be triggered by a physically present attacker who supplies crafted input via a local device or print/scan job, exploiting improper array index validation (CWE-129). Although HP's advisory bundles several vulnerabilities that could potentially enable a broader range of impacts, the specific vector for this CVE limits the effect to availability (system crash or service disruption) with no confidentiality or integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and the primary prerequisite is physical access to the target system.
Command injection (CWE-78) in HP's HPLIP (HP Linux Imaging and Printing) software enables an unauthenticated local user to execute commands or modify files with high integrity impact (VI:H) after active user interaction, matching HP's CVSS 4.0 score of 6.8 (AV:L/AC:L/PR:N/UI:A/VC:L/VI:H/VA:L) and the independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:R/C:L/I:H/A:L). The HP security bulletin HPSBPI04151 bundles this issue with other externally reported HPLIP flaws that could lead to remote code execution, privilege escalation, denial of service, or information disclosure, but the exact vulnerable component is not disclosed. No public exploit code or CISA KEV entry is identified at time of analysis, and the local vector plus mandatory user interaction prevents triggering without a user processing attacker-supplied input.
Local attackers with valid credentials on Linux systems running HPLIP can exploit symbolic-link handling flaws (CWE-61) in HPLIP components to read or modify arbitrary files, as described in HP security bulletin HPSBPI04151. This CVE is one of multiple issues remediated by HP in HPLIP and is assessed as a moderate, locally-scoped issue (CVSS 3.1: AV:L/AC:L/PR:L/UI:N, limited confidentiality/integrity impact) rather than an urgent priority, despite the broader impact list in the description; no public exploit code or CISA KEV active exploitation has been identified at time of analysis. Exploitation requires local access and a vulnerable HPLIP component that follows attacker-controllable symlinks at a predictable path, limiting impact to unauthorized file read/modification.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_store() sk_store() and kek_store() strip a trailing newline from the sysfs write before allocating the key buffer: length = count; if (buf[length - 1] == '\n') length--; bioscfg_drv.spm_data.signing_key = kmemdup(buf, length, GFP_KERNEL); but then pass the original "count" (not "length") as the copy size to hp_wmi_perform_query(), which memcpy()s that many bytes out of the "length"-sized allocation, reading one byte past it whenever the write ends in a newline, the normal case for a shell "echo" into sysfs. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in hp_wmi_perform_query+0x1e9/0x460 [hp_bioscfg] Read of size 28 at addr ffff88813c8e2b80 by task python3/16022 ... sk_store+0xa7/0x240 [hp_bioscfg] kernfs_fop_write_iter+0x3e1/0x5d0 ... The buggy address is located 0 bytes inside of allocated 27-byte region [ffff88813c8e2b80, ffff88813c8e2b9b) Reproduced identically for kek_store, and at multiple write sizes (28, 57, 201 bytes), each time reading exactly one byte past a kmemdup() allocation one byte smaller than the write. Fix by passing "length" instead of "count" to hp_wmi_perform_query() in both functions.
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write validate_password_input() computes length = strlen(buf) and then checks buf[length - 1] to strip a trailing newline, without checking that length is nonzero first. Writing an empty string (a bare '\n') to current_password or new_password gives length == 0, and buf[length - 1] reads buf[-1], one byte before the heap allocation holding the copied input. KASAN confirms this directly: BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] Read of size 1 at addr ffff88811bd8da9f by task sh/13740 ... store_password_instance.constprop.0+0x223/0x2a0 [hp_bioscfg] current_password_store+0x14/0x20 [hp_bioscfg] ... The buggy address is located 23 bytes to the right of allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88) Reproduced identically via new_password_store. Execution continues past the bad read (the garbage byte only affects whether "length" is decremented by one), so the write completes and returns success; this is a pure information read past the buffer, not a crash, but it is still an out-of-bounds access KASAN correctly flags. Fix by only checking buf[length - 1] when length is nonzero.
Uncontrolled resource consumption in HP Smart Tank All-in-One printers allows unauthenticated network attackers to render affected devices unavailable by flooding them with concurrent HTTP requests. The vulnerability (CWE-400) is rooted in the printer's embedded HTTP service failing to throttle or bound incoming connection load, causing availability loss without any authentication requirement. No public exploit code or CISA KEV listing has been identified at time of analysis, though the simplicity of the attack vector (parallel HTTP flooding) significantly lowers the skill bar for exploitation.
Cross-site scripting in HP DesignJet large-format printers allows adjacent-network unauthenticated attackers to inject malicious scripts via crafted HTTP requests that execute when a user views print job previews through the device's embedded web interface. The CVSS 4.0 vector (AV:A/VI:H) constrains the attack to local network adjacency while indicating high integrity impact - consistent with an attacker manipulating displayed print job content or forging actions within the printer's management UI. No public exploit has been identified at time of analysis, and HP has self-disclosed the issue.
Out-of-bounds heap write in Erlang OTP's binary_to_term/1 function causes virtual machine crash via a maliciously crafted Erlang external term format (ETF) binary. The vulnerability, triggered by a signed/unsigned conversion error in LARGE_TUPLE_EXT decoding, affects OTP 25.0 through 27.3.4.14, 28.5.0.3, and 29.0.3. No authentication is required, and exploitation leads to denial of service; no public exploit code has been identified at time of analysis.
Port 9100 thread exhaustion in HP ENVY 5000 series printers (firmware VERBASPP1N003.2237A.00) enables an unauthenticated attacker on the same network segment to permanently render the device unresponsive by holding TCP connections open with keep-alive packets. The firmware's complete absence of connection timeouts and concurrent session limits means all JetDirect session threads become permanently locked, requiring physical power cycling to recover - and the attack is trivially re-launched immediately after restart. No public exploit code has been identified and SSVC assigns exploitation as none, but a public researcher write-up exists on Medium, and the persistent, unrecoverable nature of the DoS makes real-world impact disproportionate to the moderate CVSS score.
Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.
Race condition in PaperCut MF badge-swipe processing from HP multifunction devices allows unauthorized user login when custom badge-ID post-processing scripts transform truncated badge strings into valid credentials of different users. The vulnerability requires specific network conditions (dropped packets, out-of-order sequence counters, failed sequence reset notifications) and custom script configuration, affecting physical device authentication in networked printing environments. No public exploit identified at time of analysis.
Stored XSS in the Hammas Calendar WordPress plugin through version 1.5.11 allows authenticated contributors and above to inject malicious scripts via the 'apix' parameter in the 'hp-calendar-manage-redirect' shortcode due to inadequate input sanitization. When users access pages containing the injected payload, the scripts execute in their browsers, potentially leading to session hijacking, credential theft, or malware distribution. No patch is currently available.
The HP BIOS configuration driver in the Linux kernel fails to validate attribute names before kobject registration, causing kernel warnings and potential denial of service when HP BIOS returns empty name strings. A local user with standard privileges can trigger this vulnerability to crash or destabilize the system by supplying malformed BIOS attribute data. No patch is currently available for this medium-severity flaw affecting Linux systems with HP BIOS configuration support.
HP OfficeJet Pro printers (D9l18a, D9l20a, D9l21a, D9l63a firmware) are vulnerable to information disclosure through CORS misconfiguration when administrators enable the feature on the Embedded Web Server. An unauthenticated remote attacker can exploit this to access sensitive device resources from untrusted web origins. CORS remains disabled by default as a mitigation, but organizations that have explicitly enabled it should apply patches when available.
HP OfficeJet Pro printers running affected firmware versions are susceptible to denial of service attacks through malformed Internet Printing Protocol (IPP) requests that prevent proper TCP connection establishment. An unauthenticated remote attacker can trigger this condition to disrupt printer availability, though no patch is currently available to mitigate the vulnerability.
In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the GSP chip and is used e.g. in HP 730 workstations.
router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor is affected by information exposure (CVSS 7.5).
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities.
Sensitive configuration data can be written into a local log file on HP Poly VideoOS and Poly TCOS endpoints when an administrator changes device settings through the Microsoft Teams Admin Center (TAC) interface. The exposure is narrow by design: the affected log is readable only by users holding administrator credentials, and the flaw does not trigger when the same configuration changes are made through the provisioning server or the device WebUI. No public exploit code has been identified at time of analysis and EPSS is low (0.40%, 32nd percentile), but the CVSS 8.1 base score overstates operational risk - the prerequisite of administrator-level access to the log sharply constrains who could actually read the leaked data, consistent with our independent assessment of a modest-priority information-disclosure issue.