{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-2209", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "state": "PUBLISHED", "assignerShortName": "hp", "dateReserved": "2024-03-05T22:45:36.860Z", "datePublished": "2024-03-26T23:49:12.512Z", "dateUpdated": "2024-08-06T18:48:35.083Z"}, "containers": {"cna": {"title": "HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code", "descriptions": [{"lang": "en", "value": "A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer\u2019s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution."}], "affected": [{"vendor": "HP, Inc.", "product": "HP Printer Firmware Update Utility", "defaultStatus": "affected", "versions": [{"version": "See HP security bulletin reference for affected versions", "status": "unknown"}]}], "references": [{"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2024-03-26T23:49:12.512Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:03:39.393Z"}, "title": "CVE Program Container", "references": [{"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-94", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "affected": [{"vendor": "hp_inc", "product": "hp_printer_firmware_update_utility", "cpes": ["cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "unknown"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-06T18:40:34.729273Z", "id": "CVE-2024-2209", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T18:48:35.083Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T19:03:39.393Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-2209", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-06T18:40:34.729273Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hp_inc:hp_printer_firmware_update_utility:*:*:*:*:*:*:*:*"], "vendor": "hp_inc", "product": "hp_printer_firmware_update_utility", "versions": [{"status": "unknown", "version": "0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-06T18:43:54.412Z"}}], "cna": {"title": "HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code", "affected": [{"vendor": "HP, Inc.", "product": "HP Printer Firmware Update Utility", "versions": [{"status": "unknown", "version": "See HP security bulletin reference for affected versions"}], "defaultStatus": "affected"}], "references": [{"url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer\u2019s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution."}], "providerMetadata": {"orgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "shortName": "hp", "dateUpdated": "2024-03-26T23:49:12.512Z"}}}, "cveMetadata": {"cveId": "CVE-2024-2209", "state": "PUBLISHED", "dateUpdated": "2024-08-06T18:48:35.083Z", "dateReserved": "2024-03-05T22:45:36.860Z", "assignerOrgId": "74586083-13ce-40fd-b46a-8e5d23cfbcb2", "datePublished": "2024-03-26T23:49:12.512Z", "assignerShortName": "hp"}, "dataVersion": "5.1"}

{"descriptions": [{"lang": "en", "value": "A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer\u2019s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution."}, {"lang": "es", "value": "Un usuario con privilegios administrativos puede crear un archivo dll comprometido con el mismo nombre que el dll original dentro del paquete Firmware Update Utility (FUU) de la impresora HP y colocarlo en el directorio de descargas predeterminado de Microsoft Windows, lo que puede conducir a una posible ejecuci\u00f3n de c\u00f3digo arbitrario."}], "id": "CVE-2024-2209", "lastModified": "2024-11-21T09:09:15.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-03-27T00:15:07.817", "references": [{"source": "hp-security-alert@hp.com", "url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.hp.com/us-en/document/ish_10354903-10354932-16"}], "sourceIdentifier": "hp-security-alert@hp.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}