A Critical RCE Vulnerability in HP Printer Devices- Let’s See How to Fix CVE-2022-28721(2)

HP has addressed two vulnerabilities of which one is RCE vulnerability rated Critical and the second is ACE vulnerability rated high in severity. Attackers can abuse these buffer overflow vulnerabilities to perform remote code execution and arbitrary code execution on vulnerable printer modules. Since the critical flaw is rated 9.8 on the CVSS scale and allows to execution of malicious code from remote, it’s important to know how to fix CVE-2022-28721, a critical RCE vulnerability in HP printer devices. The vendor has covered both the flaws in a security advisory to protect your printers against these vulnerabilities. Let’s see what is there in the advisory and see how to apply the patches to your printer modules.

Let’s start the post from the summary of the vulnerabilities and see how to fix CVE-2022-28721, a critical RCE vulnerability in HP printer devices.

Summary of CVE-2022-28721(2)

HP released a security advisory on 21st, Sep. That it disclosed two Buffer Overflow vulnerabilities, one is Critical with a CVSS score of 9.8 and another one is High in severity with 7.1 CVSS scores. These flaws are due to improper bound checking that allows an attacker to overflow a buffer and execute arbitrary code on the affected printer devices.

The critical flaw allows an attacker to execute code over the network and the high severity flaw needs authentication and physical access to execute the code. There are no technical details were published on the flaws to lower the attack possibility.

Summary of CVE-2022-28721:

Summary of CVE-2022-28722:

List HP Printer devices Affected By These Vulnerabilities

HP said that there are a long list of printer devices are affected by these vulnerabilities. The list has more than 60 printer modules. Please find the products affected by these vulnerabilities and patched firmware version that fixes the vulnerabilities. Please don’t forget to see the updated list here.

We urge you to carefully go through the table and list out the vulnerabilities identified in your modules and upgrade the firmware to the resolved version or the latest available for download.

Caution: We always recommend reading the product guide or contacting the vendor support team before upgrading firmware. A wrong firmware upgrade may either break your device or lead to permanent damage.

List of Affected HP InkJet Printers:

List of Affected HP LaserJet Pro printers:

List of Affected HP PageWide Pro printers:

How to Fix CVE-2022-28721, A Critical RCE Vulnerability in HP Printer Devices?

The manifacturer has released the patched version of firmware to fix the vulnerabilities. The users of affected products are advised to upgrade the firmware to the latest patched version shown in the previous section.

HP offers periodic firmware updates for printers to address known issues and add new features. You must update the firmware on your printer to get all the latest updates.

There could be different ways to upgrade the firmware. Firmware upgradation using the printer control panel is the direct way to upgrade the firmware on the device itself which doesn’t require a computer to have. The second method is to upgrade the firmware using the printer update utility. This is the best way to go when you have multiple printers to upgrade the firmware. It is best for small to large size corporate networks. You can learn about upgrading firmware from here. However, we have tried covering both ways in this post so that you can have an idea about the upgradation process.

Here are two supported methods to update firmware on your printer.

Method 1: Update The Firmware Via The Printer Control Panel

Use this method to update the firmware via the printer control panel and to set the printer to update the firmware with the availability of new updates automatically. However, the process varies based on the type of control panel the device has. The control panel can be any one of the following types. This method works well for homes or small businesses which will have hand countable number of printers. Watch this video to learn how to upgrade the firmware using this way.

Video Source: HPVideo Source: HP

Method 2: How To Update The Firmware Using HP Printer Update Utility?

Use this method to download and install the HP Printer Update Utility manually. This method is good for any small to large businesses which will have hundreds of printers in their facility.