HP LaserJet Pro remote administrator password leakage Vulnerability

Release date:
Updated on:

Affected Systems:
HP LaserJet Pro P1606dn
HP LaserJet Pro P1102w
HP LaserJet Pro M1218nfs MFP
HP LaserJet Pro M1217nfw MFP
HP LaserJet Pro M1216nfh MFP
HP LaserJet Pro M1214nfh MFP
HP LaserJet Pro M1213nf MFP
HP LaserJet Pro M1212nf MFP
HP LaserJet Pro CP1025nw
Description:
--------------------------------------------------------------------------------
As a world-leading high-tech provider, HP provides a wide range of products such as laptops, desktop computers, and workstations.

Some online HP Laser printers contain hard-coded URLs in the firmware. These URLs (such as http: // ip_address/dev/save_restore.xml, http: // ip_address: 8080/IoMgmt/Adapters/wifi0/WPS/Pin) can be accessed without authentication, then, obtain the plain text administrator password and other information such as WiFi settings. Affected devices include but are not limited to the following versions: HP LaserJet Pro P1102w, HP LaserJet Pro P1606dn, HP LaserJet Pro CP1025nw, HP LaserJet Pro M1212nf MFP, HP LaserJet Pro M1213nf MFP, HP LaserJet Pro M1214nfh MFP, HP LaserJet Pro M1216nfh MFP, HP LaserJet Pro M1217nfw MFP, HP LaserJet Pro M1218nfs MFP

<* Source: michal.sajdak@securitum.pl

Link: http://seclists.org/bugtraq/2013/Aug/28
Http://sekurak.pl/hp-laserjet-pro-printers-remote-admin-password-extraction/
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

HP
--
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://itrc.hp.com
Https://h20566.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay? Javax. portlet. begCacheTok = com. vignette. cachetoken & javax. portlet. endCacheTok = com. vignette. cachetoken & javax. portlet. authorization = wsrp-navigationalState % 3 DdocId % 253Demr_na-c03825817-1% 257 CdocLocale % 253D % 257 CcalledBy % 253D & javax. portlet. tpst = ba847bafb2a2d782fcbb0710b053ce01 & ac. admitted = 1375697666155.876444892.199480143