CVE-2025-43018 Certain HP LaserJet Pro Printers – Potential Information Disclosure
Unauthenticated attackers can access the local address book on certain HP LaserJet Pro printers, exposing sensitive contact information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-43018?
CVE-2025-43018 is a medium-severity vulnerability in HP, Inc. Certain HP LaserJet Pro Printers, published on 30 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Certain HP LaserJet Pro printers may be vulnerable to information disclosure when a non-authenticated user queries a device’s local address book.
Weakness: CWE-200
Which versions are affected by CVE-2025-43018?
It affects 17 products.
Products include Hp W1a28a Firmware, Hp W1a29a Firmware, Hp W1a30a Firmware, Hp W1a31a Firmware, Hp W1a32a Firmware, Hp W1a33a Firmware and 11 more.
How do I fix CVE-2025-43018?
No fix has been published for CVE-2025-43018 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-43018 being exploited?
There is no known exploitation of CVE-2025-43018 in the wild and no public exploit code.
Sources
Also known as GHSA-g79w-6h97-vrw9.