CVE-2004-2439

The remote upgrade capability in HP LaserJet 4200 and 4300 printers does not require a password, which allows remote attackers to upgrade firmware.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBPI01085	Vendor Advisory
http://securitytracker.com/id?1011671	Vendor Advisory
http://www.securityfocus.com/bid/11297
https://exchange.xforce.ibmcloud.com/vulnerabilities/17634

Configurations

Configuration 1 (hide)

OR	cpe:2.3:h:hp:color_laserjet:4650:::::::*
	cpe:2.3:h:hp:color_laserjet:5500:::::::*
	cpe:2.3:h:hp:color_laserjet:5550:::::::*
	cpe:2.3:h:hp:color_laserjet_4600::::::::
	cpe:2.3:h:hp:laserjet_2500::::::::
	cpe:2.3:h:hp:laserjet_3000::::::::
	cpe:2.3:h:hp:laserjet_3700::::::::
	cpe:2.3:h:hp:laserjet_4100_mfp::::::::
	cpe:2.3:h:hp:laserjet_4200::::::::
	cpe:2.3:h:hp:laserjet_4300::::::::
	cpe:2.3:h:hp:laserjet_9000::::::::
	cpe:2.3:h:hp:laserjet_9000_mfp::::::::
	cpe:2.3:h:hp:laserjet_9040_mpf::::::::
	cpe:2.3:h:hp:laserjet_9050::::::::
	cpe:2.3:h:hp:laserjet_9050_mpf::::::::
	cpe:2.3:h:hp:laserjet_9055::::::::
	cpe:2.3:h:hp:laserjet_9065::::::::
	cpe:2.3:h:hp:laserjet_9500::::::::
	cpe:2.3:h:hp:laserjet_9500_mpf::::::::

History

No history.

Information

Published : 2004-12-31 05:00

Updated : 2023-12-10 10:28

NVD link : CVE-2004-2439

Mitre link : CVE-2004-2439

CVE.ORG link : CVE-2004-2439

JSON object : View

Products Affected

hp

laserjet_4200
color_laserjet_4600
laserjet_9000_mfp
laserjet_4300
laserjet_9040_mpf
laserjet_2500
laserjet_9500_mpf
laserjet_9050_mpf
laserjet_9055
laserjet_9050
color_laserjet
laserjet_3000
laserjet_9065
laserjet_4100_mfp
laserjet_9500
laserjet_9000
laserjet_3700

CWE

NVD-CWE-Other

{"id": "CVE-2004-2439", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2004-12-31T05:00:00.000", "references": [{"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=PSD_HPSBPI01085", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://securitytracker.com/id?1011671", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/11297", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17634", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "The remote upgrade capability in HP LaserJet 4200 and 4300 printers does not require a password, which allows remote attackers to upgrade firmware."}], "lastModified": "2017-07-11T01:31:53.873", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:hp:color_laserjet:4650:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B57D6094-1DCC-46A7-AA67-A4EC5B6F99C0"}, {"criteria": "cpe:2.3:h:hp:color_laserjet:5500:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2ED3A1B7-F788-4E4A-80F1-1C56DEB0F434"}, {"criteria": "cpe:2.3:h:hp:color_laserjet:5550:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF8F25AF-9175-4F14-AD4D-693BBFCBFA93"}, {"criteria": "cpe:2.3:h:hp:color_laserjet_4600:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6A133B7-AEA8-4F26-8632-2CEDE9EBB66E"}, {"criteria": "cpe:2.3:h:hp:laserjet_2500:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71F75D41-DFB3-4FD2-A883-BBA8964D84D5"}, {"criteria": "cpe:2.3:h:hp:laserjet_3000:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4042B85B-8BA8-49C8-8C72-ED4B12D10C0F"}, {"criteria": "cpe:2.3:h:hp:laserjet_3700:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "17CE1760-B9BD-4002-BA5C-0AFC4A2FBFE5"}, {"criteria": "cpe:2.3:h:hp:laserjet_4100_mfp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FE20791A-6CDA-46D0-8149-82F7D21662BB"}, {"criteria": "cpe:2.3:h:hp:laserjet_4200:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4993667F-9DE8-4DC9-90B1-A6D3AB6BFB0A"}, {"criteria": "cpe:2.3:h:hp:laserjet_4300:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3B4B141B-3358-469D-8331-88C5924763EC"}, {"criteria": "cpe:2.3:h:hp:laserjet_9000:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "54C64CAE-6CC4-4B92-9364-F982CDF47F99"}, {"criteria": "cpe:2.3:h:hp:laserjet_9000_mfp:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F0E00FE-F3DB-45C2-81AE-D7189559BD42"}, {"criteria": "cpe:2.3:h:hp:laserjet_9040_mpf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2CA8D60-093D-48C7-AB10-2882F11059DE"}, {"criteria": "cpe:2.3:h:hp:laserjet_9050:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F1FEDCF-C604-49B3-B748-03BE3193792E"}, {"criteria": "cpe:2.3:h:hp:laserjet_9050_mpf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CEF03F46-4DD9-4E99-B86D-133922AC2A09"}, {"criteria": "cpe:2.3:h:hp:laserjet_9055:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7381DEDB-71A9-4882-B9DA-AFDC31D907C7"}, {"criteria": "cpe:2.3:h:hp:laserjet_9065:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F48F4812-7441-428B-B44A-E85AC64330D7"}, {"criteria": "cpe:2.3:h:hp:laserjet_9500:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9755F699-E5F7-424C-B84A-119E19A1E413"}, {"criteria": "cpe:2.3:h:hp:laserjet_9500_mpf:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DAA4E793-61D3-4D40-8245-B6BFED4109A6"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}