Technical impact
This vulnerability is a buffer overflow that can lead to remote code execution. A specially crafted WSD scan request is not properly validated by the multi‑function printer firmware, allowing an attacker to inject malicious code and potentially compromise the device, leading to elevation of privileges, data exfiltration, or disruption of service. The weakness is classified as CWE‑121.
Affected Systems
The affected devices are HP DeskJet 2800e All‑in‑One, HP DeskJet 4200 All‑in‑One, HP DeskJet 4200e All‑in‑One, HP DeskJet Ink Advantage 2800 All‑in‑One, HP DeskJet Ink Advantage 4200 All‑in‑One, and HP DeskJet Ink Advantage Ultra 4900 All‑in‑One printers. Specific firmware versions are not detailed, so any deployed units of these models should be considered vulnerable until a patch is applied.
Risk and Exploitability
The CVSS score of 8.7 indicates a high severity vulnerability. EPSS is not available, and it is not listed in the CISA KEV catalog. The likely attack vector is remote over the network via the WSD protocol; an attacker can craft a scan request that exploits the overflow. Successful exploitation would grant remote code execution on the device, potentially compromising other network resources and exposing sensitive documents.
