These ancient HP printer security flaws are still exposing 150 models to attack

Printer
(Image credit: Shutterstock)

In a quest to hone their skills by analyzing a HP multifunction printer (MFP), cybersecurity researchers have encountered a couple of bugs that can be exploited to gain remote code execution rights.

According to the researchers, the vulnerabilities, tracked as CVE-2021-39237 and CVE-2021-39238, exist in the unit’s communications board and font parser. Worryingly, they date back to at least 2013, and affect a large number of printers in HP’s stable.

“There are a few things attackers could accomplish by exploiting these flaws in the way we’ve described. These vulnerabilities give attackers an effective way to steal information: defenders are unlikely to proactively examine the security of a printer, and so the attacker can simply sit back and steal whatever information it comes across (via employees printing, scanning, etc),” the researchers shared in a FAQ.

TechRadar needs you!

We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.

>> Click here to start the survey in a new window <<

Furthermore, the researchers note that the bugs could enable the attackers to use the compromised MFP as an entry point to move through the corporate network.

Protecting printers

The researchers have used the opportunity to emphasize how organizations make themselves vulnerable to attacks by not treating printers as just another endpoint, leaving them unprotected, and oftentimes bereft of crucial updates.

Furthermore, the researchers argue that the situation isn’t helped by a lack of forensic tools that can recover evidence from MFPs and similar devices. This helps attackers exploit bugs such as the ones that they’ve discovered, while leaving little evidence of their malicious activities. 

Although HP has patched the issues, the researchers have also shared ways to help organizations secure vulnerable MFPs.

For starters, organizations should keep the USB printing option disabled to limit physical use of the device. Secondly, the researchers recommend that network printers be placed in a separate, firewalled VLAN. 

Instead of allowing computers in the network to communicate with the printers directly, they should instead interface with a dedicated print server, which should be the only point of communication to the printer.

Batten down the hatches with the help of these best firewall apps and services, and ensure your computers are protected with these best endpoint protection tools.

Mayank Sharma

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’s TechRadar Pro’s expert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Read more
Digital image of a lock.
Xerox printer security risk could let hackers sneak into your systems
HP LaserJet Pro 3000 on modern office desk
Now HP printers are being bricked following firmware update
An illustration of a hand holding a set of keys in front of a laptop, accompanied by a padlock symbol, fingerprint, and key.
Thousands of SonicWall VPN devices are facing worrying security threats
A person at a laptop with a cybersecure lock symbol floating above it.
Hackers are still using old Ivanti bugs to break into networks
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Hardware supply chain threats can undermine your endpoint infrastructure
The best free firewall
Palo Alto warns another major firewall hack has been detected
Latest in Security
Data Breach
Thousands of healthcare records exposed online, including private patient information
China
Juniper patches security flaws which could have let hackers take over your router
Representational image depecting cybersecurity protection
GitLab has patched a host of worrying security issues
Ai tech, businessman show virtual graphic Global Internet connect Chatgpt Chat with AI, Artificial Intelligence.
AI agents can be hijacked to write and send phishing attacks
China
Volt Typhoon threat group had access to American utility networks for the best part of a year
Abstract image of cyber security in action.
MassJacker malware targets those looking for pirated software
Latest in News
Super Mario Odyssey
ChatGPT is the ultimate gaming tool - here's 4 ways you can use AI to help with your next playthrough
Brad Pitt looks over his right shoulder with &#039;F1&#039; written behind him
Apple Original Films will take you behind-the-scenes of a racing cockpit in this new thrilling F1 movie trailer
AI writer
Coding AI tells developer to write it himself
Reacher looking down at another character from the Prime Video TV series Reacher
Reacher season 3 becomes Prime Video’s biggest returning show thanks to Hollywood’s biggest heavyweight
Finger Presses Orange Button Domain Name Registration on Black Keyboard Background. Closeup View
I visited the world’s first registered .com domain – and you won’t believe what it’s offering today
Image showing detail of the Leica D-Lux 8
Still can't get a Fujifilm X100VI? This premium Leica compact costs less, and it's in stock