External risk intelligence

HP LaserJet Pro Buffer Overflow and Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-27972

The vulnerability affects networked printers. While typically deployed in internal environments, these devices are sometimes inadvertently exposed to the public internet through misconfigurations or router-level port forwarding, increasing the risk of unauthorized external access.

Buffer Overflow

Hp Laserjet Pro M304 M305 W1a46a Firmware

before 002_2310a

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Certain HP LaserJet Pro printers have a critical vulnerability that could allow unauthorized access and control. The main concern is confirming relevance and exposure to this threat.

Printers can be remotely compromised.
High severity for remote code execution.
Assess your exposure and ensure printer security.

Attack Path

How an attacker could exploit the issue

An attacker could exploit vulnerabilities in HP LaserJet Pro printers by sending specially crafted network traffic. This could allow them to execute arbitrary code on the printer, potentially leading to unauthorized access or control. The attack vector is network-based, meaning an attacker could target the printer from anywhere on the network.

No authentication required.
Specially crafted network traffic.
Remote code execution.

Live Threat

Current exploitation, exposure, and threat context

HP LaserJet Pro print products, when accessible over a network, could be exploited through buffer overflow or remote code execution vulnerabilities. This could allow an attacker to potentially compromise the device's operation and any data it processes.

Printer firmware and system control could be affected.
Exploitation may occur via network access.
Unauthorized device control and data compromise are possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

The potential for remote code execution on HP LaserJet Pro printers necessitates a coordinated response. Asset owners and IT infrastructure teams are likely responsible for identifying and securing these devices. The immediate priority is to locate all affected printers, assess their network exposure and business criticality, and then determine the appropriate remediation path based on risk.

Printer fleet owners should lead remediation.
Verify network reachability and criticality.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HP LaserJet Pro hardware affected by this issue?

This advisory applies to specific HP LaserJet Pro printer models, such as the M304-M305, M404-M405, M453-M454, and MFP M428-M429 series. These devices are office printing products that manage print jobs and system tasks via internal firmware. This vulnerability concerns the software operating on these printers, specifically affecting versions prior to the 002_2310a update.

What does this vulnerability mean for my device?

This vulnerability is classified as a buffer overflow (CWE-120). In plain terms, it means the printer's software can be overwhelmed by specifically crafted data, causing it to malfunction. Because of the nature of this flaw, it could potentially allow an unauthorized person to execute their own code on the device, essentially taking control of the printer's processing functions.

How could an attacker trigger this vulnerability?

An attacker would typically need to send malicious network traffic to the printer to exploit this flaw. Because the vulnerability does not require the attacker to have pre-existing access or user interaction, it can be triggered remotely. It is important to note that sending standard print jobs or using the printer for its intended document tasks does not inherently trigger this buffer overflow condition.

Is my printer at risk if it is behind a firewall?

Halo Surface Signal indicates that while these printers are generally kept on internal networks, the risk level changes if they are accidentally reachable from the public internet. If a printer is exposed through misconfigured network settings or port forwarding, it becomes directly accessible to external actors, which significantly raises the likelihood that this vulnerability could be misused.

What should I do to secure my HP LaserJet Pro?

The most effective way to address this issue is to update your printer's firmware. Check the official HP support documentation to identify the specific update required for your model, which generally addresses the flaw by ensuring the software handles data packets safely. Beyond applying updates, verify that your printer is not directly exposed to the public internet to reduce the potential for unauthorized access.

References

support.hp.com/us-en/document/ish_7920078-7920104-16/hpsbpi03840

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.