Last Updated on 30/11/2021 by Riya
Various security vulnerabilities impacting 150 distinct HP Inc multi-functional printers (MFPs) were discovered on Tuesday by cybersecurity experts, which could be exploited by an opponent to hold the power of susceptible devices, steal delicate data, and invade networking equipment to launch other malicious activity.
F-Secure Labs researchers Timo Hirvonen and Alexander Bolshev found and notified the two flaws — together known as Printing Shellz — to HP on April 29, 2021, leading the PC maker to deliver updates previously this month. According to Hirvonen and Bolshev,
“The weaknesses exist in the devices can be used by a hacker to achieve code execution powers, with the former having physical entry and the latter being done virtually”
These two flaws include CVE-2021-39237 and CVE-2021-39238. CVE-2021-39237 is a flaw that targets HP LaserJet, HP LaserJet Managed, HP PageWide, and HP PageWide Managed printers. On the other hand, CVE-2021-39238 is a buffer overrun weakness that has been discovered in certain HP Enterprise LaserJet, HP LaserJet Managed, HP Enterprise PageWide, and HP PageWide Managed devices.
In a potential threat approach, an exploit for the font-parsing weaknesses may be placed in an infected Pdf file, followed by social engineering the victim into printing the document. In a cross-site printing exploit, staff from the targeted organization could be tricked into entering a pirate website, which would then transmit the vulnerability to the susceptible MFP directly through the web browser. According to security researchers,
“The site could be able to instantly print a file on the exposed MFP using a fraudulently generated typeface, granting the hacker code execution access on the device”
Organizations employing the impacted devices should apply the updates as soon as possible, in addition to mandating network segmentation and prohibiting printing from USB devices by default. “Since addressing these concerns is tough,” Hirvonen and Bolshev noted, “open revelation of these flaws will assist cyber attackers fully understand what to search for when attacking susceptible businesses.”
