CVE-2023-4063 Denial of service in Certain HP OfficeJet Pro Printers

Medium 5.3 Published 22 Mar 2024 Updated 28 Mar 2025

Attackers can cause a denial of service on HP OfficeJet Pro printers by sending improper eSCL URL GET requests.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-4063?

CVE-2023-4063 is a medium-severity denial of service vulnerability in Certain HP OfficeJet Pro Printers, published on 22 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.

Weakness: CWE-400

Which versions are affected by CVE-2023-4063?

It affects 42 products.

Products include Hp 1kr42a Firmware, Hp 1kr45a Firmware, Hp 1kr46a Firmware, Hp 1kr48a Firmware, Hp 1kr49a Firmware, Hp 1kr54a Firmware and 36 more.

How do I fix CVE-2023-4063?

No fix has been published for CVE-2023-4063 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2023-4063 being exploited?

There is no known exploitation of CVE-2023-4063 in the wild and no public exploit code.

Sources

Also known as GHSA-gr8j-pcj7-xr6m.