CVE-2021-3942 Memory corruption in HP Print products and Digital Sending products
Remote attackers can execute arbitrary code on HP Print and Digital Sending products via a buffer overflow in LLMNR handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-3942?
CVE-2021-3942 is a critical memory corruption vulnerability in HP Print products and Digital Sending products, published on 22 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution or LLMNR.
Weakness: CWE-119
Which versions are affected by CVE-2021-3942?
It affects 2700 products.
Products include Hp Color Laserjet Cm4540 Mfp Cc419a Firmware, Hp Color Laserjet Cm4540 Mfp Cc420a Firmware, Hp Color Laserjet Cm4540 Mfp Cc421a Firmware, Hp Color Laserjet Cm5525 Mfp Ce707a Firmware, Hp Color Laserjet Cm5525 Mfp Ce708a Firmware, Hp Color Laserjet Cm5525 Mfp Ce709a Firmware and 2694 more.
How do I fix CVE-2021-3942?
No fix has been published for CVE-2021-3942 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-3942 being exploited?
There is no known exploitation of CVE-2021-3942 in the wild and no public exploit code.
Sources
Also known as GHSA-57f3-4qgr-hcrw.