Unscored severity · published Feb 5, 2009
CVE-2008-4419
Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color…
–
CVSS
7.4%
EPSS
No
On KEV
Description
Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410, LaserJet 2420, and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
Exploitation
Is it being used?
Exploit prediction (EPSS)7.4% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
9D
9200c Digital Sender · HP
through 20081211_09.131.1 · source: NVD
CL
Color Laserjet 4370mfp · HP
through 20081211_46.211.2 · source: NVD
CL
Color Laserjet 9500mfp · HP
through 20070719_05.011.2 · source: NVD
L2
Laserjet 2410 · HP
through 20070410_08.112.3 · source: NVD
L2
Laserjet 2420 · HP
through 20070410_08.112.3 · source: NVD
L2
Laserjet 2430 · HP
through 20070410_08.112.3 · source: NVD
L4
Laserjet 4250 · HP
through 20080319_08.015.0 · source: NVD
L4
Laserjet 4345mfp · HP
through 20081211_09.131.1 · source: NVD
L4
Laserjet 4350 · HP
through 20080319_08.015.0 · source: NVD
L9
Laserjet 9040 · HP
through 20080204_08.110.0 · source: NVD
L9
Laserjet 9040mfp · HP
through 20080204_08.110.0 · source: NVD
L9
Laserjet 9050 · HP
through 20080204_08.110.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4419
h20000.www2.hp.com
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01623905
secunia.com
http://secunia.com/advisories/33779
www.securityfocus.com
http://www.securityfocus.com/archive/1/500657/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/33611
www.securitytracker.com
http://www.securitytracker.com/id?1021687
www.vupen.com
http://www.vupen.com/english/advisories/2009/0341
More from 9200c Digital Sender
–
CVE-2009-0941
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers…
–
CVE-2009-0940
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote…