On October 16, security researchers publicly announced vulnerabilities in the WiFi WPA2 standard. See the References section below for links to additional resources describing the KRACK Attacks WPA2 potential vulnerabilities in detail.
The HP printing devices and networking accessories listed below are susceptible to the applicable vulnerabilities (CVE) noted in the References section below. However, the vulnerabilities described in the CVEs can be mitigated for each of these devices and accessories as set forth in the Workarounds section below.
HP LaserJet Enterprise printers and multifunction printers
HP LaserJet Managed printers and multifunction printers
HP LaserJet Pro printers and multifunction printers
HP PageWide Enterprise printers and multifunction printers
HP PageWide Pro printers and multifunction printers
HP OfficeJet Enterprise series printers and multifunction printers
HP OfficeJet Pro printers and multifunction printers
HP Inkjet (DeskJet, Envy, PhotoSmart) printers and multifunction printers
HP DesignJet large format printers
HP JetDirect wireless print server accessories
Customers may mitigate risk for the identified vulnerabilities through one of the methods listed below. Devices vary in configuration procedures, so please refer to the product user guide for specific instructions.
Do not use unpatched clients to connect to the print device Wi-Fi Direct network. Wi-Fi Direct implementation is not impacted, but unpatched mobile devices could be subject to attack when connecting to Wi-Fi Direct
Configure the wireless access point or printer to only allow WPA2-AES/CCMP mode, thus disabling WPA-TKIP
Use only TLS enabled protocols to communicate with the printer
Turning off printer Wi-Fi and using Ethernet or USB
What can you do?
Subscribe to HP real-time security information: All HP products use a common centralized Security Bulletin process managed by HP´s Product Security Response Team (PSRT). Subscribe to HP Security Bulletins by following these steps:
Go to <http://www.hp.com/go/support>.
Click Get software and drivers.
Find your product.
Scroll to the bottom of the page and under Other support resources, click Sign up for driver, support & security alerts.
Follow the onscreen prompts to sign up for alerts.