CVE-2020-28419 Code injection in HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printer
Arbitrary code execution can occur during the installation of certain driver software or application packages on HP printers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-28419?
CVE-2020-28419 is a high-severity code injection vulnerability in HP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printer, published on 9 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
During installation with certain driver software or application packages an arbitrary code execution could occur.
Which versions are affected by CVE-2020-28419?
It affects 215 products.
Products include Hp Laserjet Managed Mfp E62665 Firmware, Hp Color Laserjet Cm4540 Mfp Firmware, Hp Color Laserjet Enterprise Flow Mfp M577 Firmware, Hp Color Laserjet Enterprise Flow Mfp M680 Firmware, Hp Color Laserjet Enterprise Flow Mfp M880z Firmware, Hp Color Laserjet Enterprise M455 Firmware and 209 more.
How do I fix CVE-2020-28419?
No fix has been published for CVE-2020-28419 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-28419 being exploited?
There is no known exploitation of CVE-2020-28419 in the wild and no public exploit code.
Sources
Also known as GHSA-whv2-gp66-q464.