CVE-2021-3705 Missing authorization in HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Series J8H60A
An unauthorized user can reconfigure or reset HP LaserJet Pro printers due to missing authorization checks, potentially disrupting operations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3705?
CVE-2021-3705 is a critical missing authorization vulnerability in HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Series J8H60A, published on 1 Nov 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Potential security vulnerabilities have been discovered on a certain HP LaserJet Pro printer that may allow an unauthorized user to reconfigure, reset the device.
Which versions are affected by CVE-2021-3705?
It affects 2 products.
Products include Hp Laserjet Pro J8h60a Firmware, Hp Laserjet Pro J8h61a Firmware.
How do I fix CVE-2021-3705?
No fix has been published for CVE-2021-3705 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-3705 being exploited?
There is no known exploitation of CVE-2021-3705 in the wild and no public exploit code.
Other vulnerabilities in HP LaserJet Pro M501 Series J8H61A; HP LaserJet Pro M501 Series J8H60A
Sources
Also known as GHSA-hrv7-95m4-5f4g.