CVE-2018-5921 Cross-site request forgery in Certain HP Enterprise Printers, HP PageWide Printers, and MFP Products
Remote attackers can exploit Cross-Site Request Forgery in HP printers to elevate privileges via malicious web requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-5921?
CVE-2018-5921 is a high-severity vulnerability in Certain HP Enterprise Printers, HP PageWide Printers, and MFP Products, published on 3 Oct 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege.
Weakness: CWE-352
Which versions are affected by CVE-2018-5921?
It affects 194 products.
Products include Hp A2w75a Firmware, Hp A2w76a Firmware, Hp A2w77a Firmware, Hp A2w78a Firmware, Hp A2w79a Firmware, Hp B3g84a Firmware and 188 more.
How do I fix CVE-2018-5921?
No fix has been published for CVE-2018-5921 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-5921 being exploited?
There is no known exploitation of CVE-2018-5921 in the wild and no public exploit code.
Other vulnerabilities in Certain HP Enterprise Printers, HP PageWide Printers, and MFP Products
Sources
Also known as GHSA-wfxr-m65m-cgmf.