CVE-2024-2209

HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code

State: Published
Severity: 6.3 Medium
Published: Mar 26, 2024
Updated: Aug 6, 2024
Reserved: Mar 5, 2024

Description

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

Scores

CVSS	Score	Vector	Source
3.1	6.3 Medium	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L	CISA-ADP

Weaknesses

CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
HP Printer Firmware Update UtilityHP, Inc.	See HP security bulletin reference for affected versionsUnknown

References

https://support.hp.com/us-en/document/ish_10354903-10354932-16

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.