CVE-2023-26301 Missing authorization in HP LaserJet Pro
Attackers can gain elevated privileges or access sensitive information on HP LaserJet Pro printers due to missing authentication on certain endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-26301?
CVE-2023-26301 is a critical missing authorization vulnerability in HP LaserJet Pro, published on 21 Jul 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.
Weakness: CWE-862
Which versions are affected by CVE-2023-26301?
It affects 19 products.
Products include Hp Color Laserjet Pro 4201-4203 4ra87f Firmware, Hp Color Laserjet Pro 4201-4203 4ra88f Firmware, Hp Color Laserjet Pro 4201-4203 4ra89a Firmware, Hp Color Laserjet Pro 4201-4203 5hh48a Firmware, Hp Color Laserjet Pro 4201-4203 5hh51a Firmware, Hp Color Laserjet Pro 4201-4203 5hh52a Firmware and 13 more.
How do I fix CVE-2023-26301?
No fix has been published for CVE-2023-26301 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-26301 being exploited?
There is no known exploitation of CVE-2023-26301 in the wild and no public exploit code.
Sources
Also known as GHSA-225m-c7c9-rg4x.