HP Enterprise LaserJet and HP LaserJet Managed printers that use FutureSmart version 5.6 and have enabled IPsec could be vulnerable to a disclosed, unpatched, critical severity vulnerability that HP have warned will take 90 days to remediate. A security bulletin was released by HP this week to inform customers of this vulnerability which includes an extensive list of all affected products. The affected FutureSmart version is no longer available for download to protect users from this vulnerability. Currently there is no evidence of this flaw being exploited in the wild. 

FutureSmart firmware is found on all HP Enterprise device, allowing users to edit printer configurations from both the printer control panel and from a web browser using remote access. The vulnerability in this firmware requires IPsec to be enabled, which is the network security protocol that secures remote and internal communications across the network, and prevents unauthorised access to endpoints. This vulnerability tracked as CVE-2023-1707 is an information disclosure vulnerability with a CVSS base score of 9.1/10. If exploited, this vulnerability could allow an attacker to intercept the ‘scan job data’ transmitted between the printer and other devices on the network, which is a system used for scan-to email or scan-to SharePoint functionality. This disclosure could give the attacker access to potentially sensitive information within the scanning job, including any credentials that were not protected by TLS or other encryption methods.  

HP will be releasing new firmware updates for all affected products, however this has not yet been made available to customers and will take approximately 90 days from the release of their security bulletin. Until this new release is available, HP suggest users rollback the firmware on affected devices to the previous FutureSmart version 5.5.0.3 which was not found to have this flaw. When the new update is released it will be listed by printer model on the HP Customer Support website on their software and driver downloads page.