Secunia

A vulnerability has been reported in various HP products, which can be exploited by malicious people to conduct cross-site request forgery attacks.

The embedded web server allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. change certain configuration settings when a logged in user to visits a malicious web page.

The vulnerability is reported in HP LaserJet M1522n MFP and HP Color LaserJet 2605dtn. Other HP LaserJet and HP Edgeline printers, HP Photosmart Printers, and HP Digital Senders products are reportedly also affected.

Solution
Do not browse untrusted web sites while being logged in to the management interface. Exit the browser when administrator tasks are complete.

Provided and/or discovered by
* Henri Lindberg, Louhi Networks
* Russ McRee

Changelog
Further details available in Customer Area

Original Advisory
HP (HPSN-2009-001):
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566

Louhi Networks:
http://www.louhinetworks.fi/advisory/HP_20090317.txt
2009-03-26: Added CVE reference.

Russ McRee:
https://holisticinfosec.org/content/view/143/45/

Deep Links
Links available in Customer Area