Unscored severity · published Mar 18, 2009
CVE-2009-0940
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote…
–
CVSS
1.1%
EPSS
No
On KEV
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 65% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
8D
8100c Digital Sender · HP
All versions, or not specified · source: NVD
9D
9100c Digital Sender · HP
All versions, or not specified · source: NVD
9D
9200c Digital Sender · HP
All versions, or not specified · source: NVD
9D
9250c Digital Sender · HP
All versions, or not specified · source: NVD
CL
Color Laserjet · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 1500 · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2500 · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2500l · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2500lse · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2500n · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2500tn · HP
All versions, or not specified · source: NVD
CL
Color Laserjet 2605dtn · HP
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0940
Vendor Advisory
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566
osvdb.org
http://osvdb.org/52847
osvdb.org
http://osvdb.org/52848
osvdb.org
http://osvdb.org/52849
Exploit
http://www.louhinetworks.fi/advisory/HP_20090317.txt
www.securityfocus.com
http://www.securityfocus.com/archive/1/501884/100/0/threaded
More from 8100c Digital Sender
–
CVE-2009-0941
The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders has no management password by default, which makes it easier for remote attackers…