1 min read

54 HP Printer Models for Enterprises Remotely Vulnerable to Attackers

Liviu ARSENE

November 23, 2017

54 HP Printer Models for Enterprises Remotely Vulnerable to Attackers

A remotely exploitable vulnerability in 54 HP printer models for enterprises has recently been found – and patched – that could allow threat actors to breach companies” infrastructure using rogue printer firmware.

Security researchers managed to bypass the printer”s signature verification process that vets legitimate firmware update files, enabling them to install tampered firmware updates that would allow for remote control over the affected printers. Although the process involved reverse engineering HP”s firmware signature validation algorithm, researchers also found other vulnerabilities that could allow cybercriminals to interfere with the printer”s operations.

“Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code,” reads the advisory.

Since enterprise printers are usually network-accessible, compromising one with rogue firmware would give cybercriminals a foothold into an organization”s network, enabling them to move laterally across networks in search of other vulnerable targets.

“With a method to construct our own HP software “Solution” packages, and another to bypass their digital signature validation mechanism, the only remaining hurdle was to build a piece of malware compatible with HP”s platform,” reads the researcher”s report.

Since the vulnerability can be weaponized to deliver any malicious payload, the risk of having these printers compromised by cybercriminals are very high, especially since they”re mostly deployed by companies.

The security advisory issued by HP lists 25 enterprise printer models affected by the arbitrary code execution flaw, and encourages everyone that has one within their infrastructure to update their firmware with the latest security patches.

For the full list of affected HP business printers, please check here.

tags


Author



Right now

Top posts

Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

Watch Out for These Ongoing Bank of America Phishing Campaigns Targeting Customers in the US

July 16, 2021

3 min read
How to protect yourself against cyberstalking

How to protect yourself against cyberstalking

July 06, 2021

2 min read
The Top Five Security Risks Smartphone Users Face Today

The Top Five Security Risks Smartphone Users Face Today

July 02, 2021

4 min read
Phishing Alert: Scammers Use Fake SharePoint and DocuSign Messages to Steal Users’ Login Credentials

Phishing Alert: Scammers Use Fake SharePoint and DocuSign Messages to Steal Users’ Login Credentials

July 02, 2021

3 min read
Your Doxxing Dossier Will Keep Growing Thicker Until You See the Danger

Your Doxxing Dossier Will Keep Growing Thicker Until You See the Danger

June 30, 2021

2 min read
Mobile security threats: reality or myth?

Mobile security threats: reality or myth?

June 13, 2021

3 min read

FOLLOW US ON

SOCIAL MEDIA


You might also like

Fraud Family cybercrime ring under the spotlight as arrests made in the Netherlands Fraud Family cybercrime ring under the spotlight as arrests made in the Netherlands
Graham CLULEY

July 23, 2021

3 min read
Homoglyph domains used in BEC scams shut down by Microsoft Homoglyph domains used in BEC scams shut down by Microsoft
Graham CLULEY

July 22, 2021

3 min read
China Sets Up New Worrying Vulnerability Disclosure Rules China Sets Up New Worrying Vulnerability Disclosure Rules
Silviu STAHIE

July 20, 2021

1 min read