Stack-based buffer overflow in HP Development Company products - CVE-2022-24293

Vulnerability identifier: #VU61597

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24293

CWE-ID: CWE-121

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the eContactRestore within the address book feature. A remote user on the local network can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

HP Color LaserJet Pro MFP M2XX
HP OfficeJet Pro 8740 All-in-One Printer series
HP OfficeJet Pro 8730 All-in-One Printer
HP OfficeJet Pro 8216 Printer series
HP OfficeJet Pro 8210 Printer series
HP Color LaserJet Pro MFP M478
HP LaserJet Pro MFP M429 F
HP LaserJet Pro MFP M429
HP LaserJet Pro M405
HP Color LaserJet Pro M453 - M454
HP Color LaserJet Pro MFP M479
HP LaserJet Pro M304
HP LaserJet Pro M305
HP LaserJet Pro M404
HP LaserJet Pro MFP M428
HP PageWide Managed P55250dw Printer series
HP PageWide Managed P57750dw Multifunction Printer
HP PageWide Pro 452dn Printer series
HP PageWide Pro 452dw Printer series
HP PageWide Pro 477dn Multifunction Printer series
HP PageWide Pro 477dw Multifunction Printer series
HP PageWide Pro 552dw Printer series
HP PageWide Pro 577 Multifunction Printer series
HP PageWide 377dw Multifunction Printer
HP PageWide 352dw Printer

Install updates from vendor's website.

HP OfficeJet Pro 8740 All-in-One Printer series - update to 001.2207C
HP OfficeJet Pro 8730 All-in-One Printer - update to 001.2207C
HP OfficeJet Pro 8216 Printer series - update to 001.2210 B
HP OfficeJet Pro 8210 Printer series - update to 001.2210 B
HP Color LaserJet Pro MFP M478 - update to 002_2208A
HP LaserJet Pro MFP M429 F - update to 002_2208A
HP LaserJet Pro MFP M429 - update to 002_2208A
HP LaserJet Pro M405 - update to 002_2208A
HP Color LaserJet Pro M453 - M454 - update to 002_2208A
HP Color LaserJet Pro MFP M479 - update to 002_2208A
HP LaserJet Pro M304 - update to 002_2208A
HP LaserJet Pro M305 - update to 002_2208A
HP LaserJet Pro M404 - update to 002_2208A
HP LaserJet Pro MFP M428 - update to 002_2208A
HP PageWide Managed P55250dw Printer series - update to 2205D
HP PageWide Managed P57750dw Multifunction Printer - update to 2205D
HP PageWide Pro 452dn Printer series - update to 2205D
HP PageWide Pro 452dw Printer series - update to 2205D
HP PageWide Pro 477dn Multifunction Printer series - update to 2205D
HP PageWide Pro 477dw Multifunction Printer series - update to 2205D
HP PageWide Pro 552dw Printer series - update to 2205D
HP PageWide Pro 577 Multifunction Printer series - update to 2205D
HP PageWide 377dw Multifunction Printer - update to 2205D
HP PageWide 352dw Printer - update to 2205D

• https://support.hp.com/us-en/document/ish_5950417-5950443-16
• https://www.zerodayinitiative.com/advisories/ZDI-22-533/

• Multiple vulnerabilities in HP Print Products