F-Secure discovers vulnerabilities affecting over 150 HP printer models

HP issues patches for security vulnerabilities that threat actors can exploit to steal information or conduct other attacks on organizations.

Helsinki, Finland – November 30, 2021: HP Inc. has issued patches that fix security vulnerabilities cyber security provider F-Secure discovered in over 150 of their multifunction printer (MFP) products. According to research published today by F-Secure, attackers can exploit the vulnerabilities to seize control of vulnerable devices, steal information, and further infiltrate networks to inflict other types of damage.

F-Secure security consultants Timo Hirvonen and Alexander Bolshev discovered exposed physical access port vulnerabilities (CVE-2021-39237) and font parsing vulnerabilities (CVE-2021-39238) in HP’s MFP M725z – part of HP’s FutureSmart line of printers. Security advisories published by HP list over 150 different products affected by the vulnerabilities.

The most effective method would involve tricking a user from a targeted organization into visiting a malicious website, exposing the organization's vulnerable MFP to what’s known as a cross-site printing attack. The website would, automatically, remotely print a document containing a maliciously-crafted font on the vulnerable MFP, giving the attacker code execution rights on the device.

An attacker with these code execution rights could silently steal any information ran (or cached) through the MFP. This includes not only documents that are printed, scanned, or faxed, but also information like passwords and login credentials that connect the device to the rest of the network. Attackers could also use compromised MFPs as a beachhead to penetrate further into an organization’s network in pursuit of other objectives (such as stealing or changing other data, spreading ransomware, etc.)

While the researchers determined that exploiting the vulnerabilities is difficult enough to prevent many low-skilled attackers from using them, experienced threat actors could make use of them in more targeted operations. 

Furthermore, the researchers discovered the font parsing vulnerabilities are wormable, meaning attackers could create self-propagating malware that automatically compromises affected MFPs and then spreads to other vulnerable units on the same network.

“It’s easy to forget that modern MFPs are fully-functional computers that threat actors can compromise just like other workstations and endpoints. And just like other endpoints, attackers can leverage a compromised device to damage an organization's infrastructure and operations. Experienced threat actors see unsecured devices as opportunities, so organizations that don’t prioritize securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research,” explained Hirvonen.

Advice for securing MFPs

Considering HP’s status as a leading provider of MFPs with an estimated 40% of the hardware peripheral market*, many companies throughout the globe are likely using vulnerable devices.

Hirvonen and Bolshev contacted HP last spring with their findings and worked with them to help patch the vulnerabilities. HP has now published firmware updates and security advisories for the affected devices.

While the attack’s difficulty makes it impractical for some threat actors, the researchers say that it’s important for organizations targeted by advanced attacks to secure their vulnerable MFPs.

In addition to patching, measures for securing MFPs include:

  • Limiting physical access to MFPs.
  • Segregating MFPs in a separate, firewalled VLAN.
  • Using anti-tamper stickers to signal physical tampering with devices.
  • Using locks (such as Kensington locks) to control access to internal hardware.
  • Following vendors’ best practices for preventing unauthorized modifications to security settings.
  • Placing MFPs in CCTV-monitored areas to record any physical usage of a hacked device at the time it was compromised.

“Large enterprises, companies working in critical sectors, and other organizations facing highly-skilled, well-resourced attackers need to take this seriously. There’s no need to panic, but they should assess their exposure, so they’re prepared for these attacks. Although the attack is advanced, it can be mitigated with the basics: network segmentation, patch management, and security hardening,” said Hirvonen.

A detailed technical write-up of the research is available on F-Secure Labs: https://labs.f-secure.com/publications/printing-shellz.

*Source: https://www.idc.com/promo/hardcopy-peripherals

About F-Secure

F-Secure makes every digital moment more secure, for everyone. We deliver brilliantly simple, frictionless security experiences that make life easier for the tens of millions of people we protect and our 170 service provider partners. For more than 30 years, we’ve led the cyber security industry, inspired by a pioneering spirit born out of a shared commitment to do better by working together.

f-secure.com | twitter.com/fsecure | linkedin.com/f-secure

F-Secure media relations

Adam Pilkey

PR Content Manager

+358 40 637 8859

Press list

Sign up for media information from F-Secure.

We process the personal data you share with us in accordance with our Corporate Business Privacy Policy.

Press archive

By year

Browse through our news by year.

By category

Browse through our news by category.