Hp Output Central
Monthly
HP Advance server software contains a path traversal vulnerability (CWE-22) in its HP AC Print & Scan and HP Output Central components, allowing unauthenticated remote attackers to write arbitrary files, which can lead to remote code execution or privilege escalation. The vendor CVSS 4.0 vector (8.8) rates it network-reachable and unauthenticated with high integrity and availability impact, but HP notes impact occurs 'under certain conditions,' implying unstated deployment prerequisites that may narrow actual exploitability; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-management server hosting HP AC Print & Scan or HP Output Central achieve elevation of privilege, remote code execution, or arbitrary file write, as described in HP's self-published advisory hpsbpi04149 (CVSS 4.0 base score 9.3 Critical, CWE-94). The vendor scores both the vulnerable component (VC:H/VI:L) and subsequent systems (SC:H/SI:H) as impacted, and our independent assessment retains a high-severity rating (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) while noting that HP's explicit 'under certain conditions' wording implies a specific feature, endpoint, or deployment mode is a likely precondition despite the AC:L rating. Exploitation requires no authentication and no user interaction per the CVSS vector, but there is no CISA KEV entry, no public exploit code identified at time of analysis, and no affected version range published by the vendor.
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. No public exploit code has been identified at time of analysis, though the vendor's CVSS 4.0 vector rates it 9.3 critical while an independent assessment adjusts attack complexity to High due to the gating conditions.
HP Advance server software contains a path traversal vulnerability (CWE-22) in its HP AC Print & Scan and HP Output Central components, allowing unauthenticated remote attackers to write arbitrary files, which can lead to remote code execution or privilege escalation. The vendor CVSS 4.0 vector (8.8) rates it network-reachable and unauthenticated with high integrity and availability impact, but HP notes impact occurs 'under certain conditions,' implying unstated deployment prerequisites that may narrow actual exploitability; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated remote code injection in HP Advance can let an attacker with network reachability to the print-management server hosting HP AC Print & Scan or HP Output Central achieve elevation of privilege, remote code execution, or arbitrary file write, as described in HP's self-published advisory hpsbpi04149 (CVSS 4.0 base score 9.3 Critical, CWE-94). The vendor scores both the vulnerable component (VC:H/VI:L) and subsequent systems (SC:H/SI:H) as impacted, and our independent assessment retains a high-severity rating (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) while noting that HP's explicit 'under certain conditions' wording implies a specific feature, endpoint, or deployment mode is a likely precondition despite the AC:L rating. Exploitation requires no authentication and no user interaction per the CVSS vector, but there is no CISA KEV entry, no public exploit code identified at time of analysis, and no affected version range published by the vendor.
Unauthenticated remote code execution and privilege escalation in HP Advance software can lead to full server compromise, but exploitation requires specific, undisclosed configuration or deployment conditions according to HP's advisory. The flaw affects the HP AC Print & Scan and HP Output Central components hosted on the HP Advance server. No public exploit code has been identified at time of analysis, though the vendor's CVSS 4.0 vector rates it 9.3 critical while an independent assessment adjusts attack complexity to High due to the gating conditions.