HPSBPI03569 rev 4 - HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP OfficeJet Enterprise printers, Execution of arbitrary code

Potential Security Impact

Execution of arbitrary code

Source: NTT Security

Reported By: Stephen Breen

VULNERABILITY SUMMARY

Insufficient Solution DLL Signature Validation allows potential execution of arbitrary code.

RESOLUTION

Available Mitigation Settings:

The vulnerability can be avoided by either of the following actions:

• Set the Local Administrator password for the Embedded Web Server (EWS).

Open the printer EWS, click the Security tab, then locate the Local Administrator Password section.

• Disable Allow firmware upgrades sent as print jobs (Port 9100) setting.

Open the printer EWS, click the Security tab, then locate the Firmware Upgrade Security section.

These recommendations are documented in HP Printing Security Best Practices for HP LaserJet Enterprise Printers.

• See page 35 for EWS administrator password configuration.

• See page 37 for Allow firmware upgrades sent as print jobs configuration.