A security issue has been reported in various HP LaserJet Printers and HP Digital Senders, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to an error within the Remote Firmware Update (RFU) mechanism, which does not check for authentication when handling firmware updates. This can be exploited to upload a malicious firmware to device via a specially crafted request to TCP port 9100.

Please see the vendor's advisory for the list of affected products.

Solution
Apply firmware update. Please see the vendor's advisory for details. As a workaround disable the "Printer Firmware Update" setting.

Provided and/or discovered by
Salvatore Stolfo and Ang Cui, Columbia University.

Changelog
Further details available to Secunia VIM customers

Original Advisory
HPSBPI02728 SSRT100692:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay/?docId=emr_na-c03102449

Other references
Further details available to Secunia VIM customers

Deep Links
Links available to Secunia VIM customers