External risk intelligence

HP LaserJet Pro Heap Overflow and Remote Code Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-27973

Affected devices are network printers designed for local use. While public internet exposure is not a standard deployment pattern, they often feature web-based management interfaces or print services that can become inadvertently exposed to the internet through misconfiguration or insecure network bridging, creating a remote attack surface for these critical vulnerabilities.

Out-of-bounds Write

Hp Laserjet Pro M304 M305 W1a46a Firmware

before 002_2310a

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Certain HP LaserJet Pro printers have a critical vulnerability that could allow unauthorized access and control. This issue affects network-connected devices and poses a risk if they are accessible from outside the internal network.

Printers can be remotely controlled.
Critical flaws affect many HP LaserJet models.
Assess your network for exposure risks.

Attack Path

How an attacker could exploit the issue

An attacker could target HP LaserJet Pro printers over the network to trigger vulnerabilities in the device's firmware. By sending specially crafted network data, an attacker could potentially overflow the printer's memory, leading to unauthorized code execution. This could allow an attacker to compromise the printer's functionality or use it as a pivot point into a network.

Network access is required.
Specially crafted data triggers vulnerability.
Risk of code execution and compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability affects HP LaserJet Pro print products, potentially allowing for heap overflow and remote code execution. When exposed to a network, an attacker could leverage these flaws to compromise the printer's functionality.

Printer firmware and network access are at risk.
Vulnerabilities could be exploited over a network.
Malicious code execution on the printer may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects HP LaserJet Pro printers, placing responsibility on infrastructure or platform teams for inventory and assessment. The initial step is to locate all instances of the affected printers, determine their network accessibility and criticality, and then identify the responsible asset owner to plan remediation.

Identify printer locations and owner.
Verify network exposure and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the affected HP LaserJet Pro software?

These products are enterprise-grade network printers utilized in offices for high-volume document production. The affected components are the device firmware, which provides the internal operating environment for network communication, print job processing, and administrative management interfaces.

What is the vulnerability behind CVE-2023-27973?

This vulnerability is classified as CWE-787, or an Out-of-bounds Write, specifically manifesting as a heap overflow. In plain terms, the software fails to properly check the size of incoming data before storing it in memory. An attacker can send specially crafted, oversized data that overwrites adjacent memory, potentially leading to unauthorized remote code execution.

How can an attacker trigger this issue?

The attack requires sending a malicious data packet to the printer over the network. Because the vulnerability involves how the printer processes communication, it does not require an attacker to have physical access to the device. Note that simply using the printer for standard document output does not trigger the bug; the trigger requires specific, malformed network traffic intended to exploit the memory handling flaw.

Is my printer at risk if it is not on the internet?

Halo Surface Signal indicates that while these devices are designed for local use, they often include web-based management tools. Even if not intentionally placed on the public internet, printers can become accessible through misconfigured network bridges or firewall settings. Any device reachable over a network that an unauthorized user can access is at higher risk, as this vulnerability is reachable via network communication.

What steps should I take to address CVE-2023-27973?

The primary response is to update the device firmware. You should verify your specific printer model and firmware version against the vendor's support documentation. Applying the latest security updates provided by the manufacturer resolves the underlying memory handling error, effectively closing the window for this specific type of exploit.

References

support.hp.com/us-en/document/ish_7920137-7920161-16/hpsbpi03841

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.