HP has issued two security advisories describing remote code execution and denial of service vulnerabilities that affect hundreds of different HP network printers.
Remote code execution and buffer overflow
Certain HP Print products and Digital Sending products may be vulnerable to potential remote code execution and buffer overflow with use of Link-Local Multicast Name Resolution or LLMNR.
HP
Tracked as CVE-2022-3942 with a Critical severity rating, this vulnerability can be resolved either by upgrading the printer firmware or, on some models, disabling the Link-Local Multicast Name Resolution feature on the printer.
LLMNR is a (legacy) protocol that provides name resolution without the need for a DNS server. LLMNR works by sending a multicast packet on UDP 5355 asking for any listening system to identify if they are the hostname included in the query. The implicit trust model of LLMNR is open to abuse. For example, on a windows network if LLMNR is enabled a PC can use it to identify a file server and whoever replies will be sent the hashed login credentials of the user trying to connect to the fileserver. If the reply comes from an malicious impersonator rather than the fileserver in question then the malicious device has now managed to harvest the credentials of the user. The opportunities for abuse are clear.
If you want to check if LLMNR is disabled on you Active Directory domain look for a GPO under Computer Configuration -> Administrative Templates -> Network -> DNS ClientEnable Turn Off Multicast Name Resolution. If this is set to Enabled then LLMNR is turned off on your domain.
HP provides instructions on how to disable unused network protocols on their Enterprise printers in the security advisory.
Remote Code Execution and Denial of Service
Two critical and one high severity vulnerability are covered in a second security advisory from HP.
Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
HP
21 printer models are affected from the OfficeJet Pro, LaserJet Pro and PageWide Pro ranges, and in each case a new firmware version is required to mitigate the vulnerabilities.
Tracked as CVE-2022-24293, CVE-2022-24292 and CVE-2022-24291, the guidance on how to resolve these issues is contained in HP’s security advisory.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)