Buffer overflow in HP Development Company products - CVE-2022-28721

Vulnerability identifier: #VU67637

CSH Severity: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2022-28721

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
HP DeskJet Ink Advantage 5000 All-in-One Printer series
HP DeskJet Ink Advantage 5200 All-in-One Printer series
HP DeskJet Plus Ink Advantage 6000 All-in-One Printer series
HP DeskJet Plus Ink Advantage 6400 All-in-One Printer series
HP ENVY 5000 All-in-One Printer series
HP ENVY 6000 All-in-One Printer series
HP ENVY 6000e All-In-One Printer series
HP ENVY 6400e All-In-One Printer series
HP ENVY Photo 6200 All-in-One Printer series
HP ENVY Photo 7100 All-in-One Printer series
HP ENVY Photo 7800 All-in-One Printer series
HP ENVY Pro 6400 All-in-One Printer series
HP OfficeJet 5200 All-in-One Printer series
HP OfficeJet 6950 All-in-One Printer series
HP OfficeJet 6960 All-in-One Printer series
HP OfficeJet 8010 All-in-One Printer series
HP OfficeJet 8010e All-in-One Printer series
HP OfficeJet 8022 All-in-One Printer
HP OfficeJet 8022e All-in-One Printer
HP OfficeJet Pro 6960 All-in-One Printer series
HP OfficeJet Pro 6970 All-in-One Printer series
HP OfficeJet Pro 7720 Wide Format All-in-One Printer series
HP OfficeJet Pro 7730 Wide Format All-in-One Printer
HP OfficeJet Pro 7740 Wide Format All-in-One Printer series
HP OfficeJet Pro 8020 All-in-One Printer series
HP OfficeJet Pro 8020e All-in-One Printer series
HP OfficeJet Pro 8030 All-in-One Printer series
HP OfficeJet Pro 8030e All-in-One Printer series
HP OfficeJet Pro 8035e All-in-One Printer
HP OfficeJet Pro 8210 Printer series
HP OfficeJet Pro 8730 All-in-One Printer
HP OfficeJet Pro 8740 All-in-One Printer series
HP OfficeJet Pro 9010 All-in-One Printer series
HP OfficeJet Pro 9010e All-in-One Printer series
HP OfficeJet Pro 9020 All-in-One Printer series
HP OfficeJet Pro 9020e All-in-One Printer series
HP Smart Tank 510 Wireless All-in-One series
HP Smart Tank Plus 550 Wireless All-in-One series
HP Smart Tank 610 Wireless All-in-One series
HP Smart Tank Plus 650 Wireless All-in-One series
HP Tango
HP Tango X
HP Color LaserJet MFP M478-M479 series
HP Color LaserJet Pro M453-M454 series
HP LaserJet Pro M304-M305 Printer series
HP LaserJet Pro M404-M405 Printer series
HP LaserJet Pro MFP M428-M429 f series
HP LaserJet Pro MFP M428-M429 series
HP PageWide 352dw Printer
HP PageWide 377dw Multifunction Printer
HP PageWide Managed P55250dw Printer series
HP PageWide Managed P57750dw Multifunction Printer
HP PageWide Managed P75050dn
HP PageWide Managed P75050dw
HP PageWide Managed P77740dn Multifunction Printer
HP PageWide Managed P77740dw Multifunction Printer
HP PageWide Managed P77740z Multifunction Printer
HP PageWide Managed P77750z Multifunction Printer
HP PageWide Managed P77760z Multifunction Printer
HP PageWide Pro 452dn Printer series
HP PageWide Pro 452dw Printer series
HP PageWide Pro 477dn Multifunction Printer series
HP PageWide Pro 477dw Multifunction Printer series
HP PageWide Pro 552dw Printer series
HP PageWide Pro 577 Multifunction Printer series
HP PageWide Pro 750dn Printer
HP PageWide Pro 750dw Printer
HP PageWide Pro 772dn Multifunction Printer
HP PageWide Pro 772dw Multifunction Printer

Software vendor:
HP Development Company

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install updates from vendor's website.

• https://support.hp.com/us-en/document/ish_6839789-6839813-16/HPSBPI03810