CVE-2023-35175 Server-side request forgery in HP LaserJet Pro

Critical 9.8 Published 30 Jun 2023 Updated 4 Dec 2024

Attackers can achieve remote code execution or privilege escalation on HP LaserJet Pro printers via Server-Side Request Forgery in the Web Service Eventing model.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-35175?

CVE-2023-35175 is a critical server-side request forgery vulnerability in HP LaserJet Pro, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain HP LaserJet Pro print products are potentially vulnerable to Potential Remote Code Execution and/or Elevation of Privilege via Server-Side Request Forgery (SSRF) using the Web Service Eventing model.

Weakness: CWE-918

Which versions are affected by CVE-2023-35175?

It affects 38 products.

Products include Hp Laserjet Pro M304-M305 W1a46a Firmware, Hp Laserjet Pro M304-M305 W1a47a Firmware, Hp Laserjet Pro M304-M305 W1a48a Firmware, Hp Laserjet Pro M304-M305 W1a66a Firmware, Hp Laserjet Pro M404-M405 93m22a Firmware, Hp Laserjet Pro M404-M405 W1a51a Firmware and 32 more.

How do I fix CVE-2023-35175?

No fix has been published for CVE-2023-35175 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-35175 being exploited?

There is no known exploitation of CVE-2023-35175 in the wild and no public exploit code.

Sources

Also known as GHSA-m29g-62vq-8hcx.