#VU14194 Buffer overflow in HPE products - CVE-2018-5924


| Updated: 2020-05-18

Vulnerability identifier: #VU14194

Vulnerability risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2018-5924

CWE-ID: CWE-120

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
HP Smart Tank Wireless 450
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 7520 series
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 6520 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 525 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 5524 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 5522 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 5521 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Photosmart 5520 series e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8740
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8732M All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8730
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8720 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8710 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 8660 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 8640 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 8630 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 8620 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 8610 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8600A Premium e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8600A Plus e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8600A e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8216
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 8210 Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 7740 Wide Format All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 7730 Wide Format All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 7720 Wide Format All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 6970 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 6830 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 276dw Multifunction Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet Pro 251dw Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 7612 Wide Format e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 7510 Wide Format All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 7110 Wide Format ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet Pro 6960 All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 6960 All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 6950 All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 6810/6820 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 6700 Premium e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 6600 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 6220 / HP Officejet Pro 6230 ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 5740 series
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 5200 AlI-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 4650 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 4630 e-All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 4622 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 4620 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 4610 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 3830 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Officejet 2620 series
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 252 Mobile All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 202 Mobile series
Hardware solutions / Office equipment, IP-phones, print servers
HP OfficeJet 200 Mobile series
Hardware solutions / Office equipment, IP-phones, print servers
HP Ink Tank Wireless 410
Hardware solutions / Office equipment, IP-phones, print servers
HP Ink Tank 310
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY Photo 7100 All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY Photo 6200 All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 7640 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 5660 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 5640 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 5540 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 5530 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 5000 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 4520 series
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 4510 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP ENVY 4500 series
Hardware solutions / Office equipment, IP-phones, print servers
HP Envy 120 Series
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 6525 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet Ink Advantage 5570 All-in-One printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 5525 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet Ink Advantage 4670 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 4640 e-All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 4625 e-All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 4615 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 3830 e-All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet Ink Advantage 3700 All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet Ink Advantage 3630 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet Ink Advantage 2600 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet Ink Advantage 2540 All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 5730 series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 5640 series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 5275 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 5000 series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 4720 series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 4530 series
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet 4510 series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 3700 All-in-One Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 3630 series
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet 3540 series
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet 2620 Ink Advantage series
Hardware solutions / Office equipment, IP-phones, print servers
HP DeskJet 2600 All-in-One Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Deskjet 2540 All-in-One
Hardware solutions / Office equipment, IP-phones, print servers
HP AMP 1xx Printerseries
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T830 MFP with Rugged Case
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T830 MFP with Armour Case
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T830 MFP with Armor Case
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T830 24-in MFP Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T830 24in eMFP Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T730 with Rugged Case
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet T730 36in Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 36-in Rmkt ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 36-in Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 36-in ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 24-in Rmkt ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 24-in Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T520 24-in ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T120 24-in Rmkt ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T120 24-in Printer (2018 edition)
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T120 24-in Printer
Hardware solutions / Office equipment, IP-phones, print servers
HP Designjet T120 24-in ePrinter
Hardware solutions / Office equipment, IP-phones, print servers
HP DesignJet rugged case
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Pro MFP 772dw
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Pro MFP 772dn
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Pro 750dw
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Pro 750dn
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed P75050dw
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed P75050dn
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed MFP P77760z
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed MFP P77750z
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed MFP P77740z
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed MFP P77740dw
Hardware solutions / Office equipment, IP-phones, print servers
HP PageWide Managed MFP P77740dn
Hardware solutions / Office equipment, IP-phones, print servers

Vendor: HPE

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to buffer overflow when handling malicious input. A remote unauthenticated attacker can send a specially crafted file, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation
Install update from vendor's website.

Vulnerable software versions

HP Smart Tank Wireless 450: All versions

HP Photosmart 7520 series: All versions

HP Photosmart 6520 e-All-in-One: All versions

HP Photosmart 525 e-All-in-One: All versions

HP Photosmart 5524 e-All-in-One: All versions

HP Photosmart 5522 e-All-in-One: All versions

HP Photosmart 5521 e-All-in-One: All versions

HP Photosmart 5520 series e-All-in-One: All versions

HP OfficeJet Pro 8740: All versions

HP OfficeJet Pro 8732M All-in-One Printer: All versions

HP OfficeJet Pro 8730: All versions

HP OfficeJet Pro 8720 All-in-One Printer: All versions

HP OfficeJet Pro 8710 All-in-One Printer: All versions

HP Officejet Pro 8660 e-All-in-One Printer: All versions

HP Officejet Pro 8640 e-All-in-One Printer: All versions

HP Officejet Pro 8630 e-All-in-One Printer: All versions

HP Officejet Pro 8620 e-All-in-One Printer: All versions

HP Officejet Pro 8610 e-All-in-One Printer: All versions

HP OfficeJet Pro 8600A Premium e-All-in-One: All versions

HP OfficeJet Pro 8600A Plus e-All-in-One: All versions

HP OfficeJet Pro 8600A e-All-in-One: All versions

HP OfficeJet Pro 8216: All versions

HP OfficeJet Pro 8210 Printer: All versions

HP OfficeJet Pro 7740 Wide Format All-in-One: All versions

HP OfficeJet Pro 7730 Wide Format All-in-One: All versions

HP OfficeJet Pro 7720 Wide Format All-in-One: All versions

HP OfficeJet Pro 6970 All-in-One Printer: All versions

HP Officejet Pro 6830 e-All-in-One Printer: All versions

HP Officejet Pro 276dw Multifunction Printer: All versions

HP Officejet Pro 251dw Printer: All versions

HP Officejet 7612 Wide Format e-All-in-One: All versions

HP Officejet 7510 Wide Format All-in-One Printer: All versions

HP Officejet 7110 Wide Format ePrinter: All versions

HP OfficeJet Pro 6960 All-in-One: All versions

HP OfficeJet 6960 All-in-One: All versions

HP OfficeJet 6950 All-in-One: All versions

HP Officejet 6810/6820 e-All-in-One Printer: All versions

HP OfficeJet 6700 Premium e-All-in-One: All versions

HP OfficeJet 6600 e-All-in-One: All versions

HP Officejet 6220 / HP Officejet Pro 6230 ePrinter: All versions

HP Officejet 5740 series: All versions

HP OfficeJet 5200 AlI-in-One Printer: All versions

HP OfficeJet 4650 All-in-One Printer: All versions

HP Officejet 4630 e-All-in-One Printerseries: All versions

HP Officejet 4622 e-All-in-One Printer: All versions

HP Officejet 4620 e-All-in-One Printer: All versions

HP Officejet 4610 e-All-in-One Printer: All versions

HP Officejet 3830 e-All-in-One Printer: All versions

HP Officejet 2620 series: All versions

HP OfficeJet 252 Mobile All-in-One: All versions

HP OfficeJet 202 Mobile series: All versions

HP OfficeJet 200 Mobile series: All versions

HP Ink Tank Wireless 410: All versions

HP Ink Tank 310: All versions

HP ENVY Photo 7100 All-in-One Printerseries: All versions

HP ENVY Photo 6200 All-in-One Printerseries: All versions

HP ENVY 7640 series: All versions

HP ENVY 5660 series: All versions

HP ENVY 5640 series: All versions

HP ENVY 5540 All-in-One Printer: All versions

HP ENVY 5530 series: All versions

HP ENVY 5000 series: All versions

HP ENVY 4520 series: All versions

HP ENVY 4510 All-in-One Printer: All versions

HP ENVY 4500 series: All versions

HP Envy 120 Series: All versions

HP Deskjet Ink Advantage 6525 e-All-in-One: All versions

HP DeskJet Ink Advantage 5570 All-in-One printer: All versions

HP Deskjet Ink Advantage 5525 e-All-in-One: All versions

HP DeskJet Ink Advantage 4670 All-in-One Printer: All versions

HP Deskjet Ink Advantage 4640 e-All-in-One Printerseries: All versions

HP Deskjet Ink Advantage 4625 e-All-in-One: All versions

HP Deskjet Ink Advantage 4615 All-in-One Printer: All versions

HP Deskjet Ink Advantage 3830 e-All-in-One Printer: All versions

HP DeskJet Ink Advantage 3700 All-in-One Printerseries: All versions

HP DeskJet Ink Advantage 3630 All-in-One Printer: All versions

HP DeskJet Ink Advantage 2600 All-in-One Printer: All versions

HP Deskjet Ink Advantage 2540 All-in-One: All versions

HP DeskJet 5730 series: All versions

HP DeskJet 5640 series: All versions

HP DeskJet 5275 All-in-One Printer: All versions

HP DeskJet 5000 series: All versions

HP DeskJet 4720 series: All versions

HP DeskJet 4530 series: All versions

HP Deskjet 4510 series: All versions

HP DeskJet 3700 All-in-One Printerseries: All versions

HP DeskJet 3630 series: All versions

HP Deskjet 3540 series: All versions

HP Deskjet 2620 Ink Advantage series: All versions

HP DeskJet 2600 All-in-One Printer: All versions

HP Deskjet 2540 All-in-One: All versions

HP AMP 1xx Printerseries: All versions

HP DesignJet T830 MFP with Rugged Case: All versions

HP DesignJet T830 MFP with Armour Case: All versions

HP DesignJet T830 MFP with Armor Case: All versions

HP DesignJet T830 24-in MFP Printer: All versions

HP DesignJet T830 24in eMFP Printer: All versions

HP Designjet T730 with Rugged Case: All versions

HP DesignJet T730 36in Printer: All versions

HP Designjet T520 36-in Rmkt ePrinter: All versions

HP Designjet T520 36-in Printer: All versions

HP Designjet T520 36-in ePrinter: All versions

HP Designjet T520 24-in Rmkt ePrinter: All versions

HP Designjet T520 24-in Printer: All versions

HP Designjet T520 24-in ePrinter: All versions

HP Designjet T120 24-in Rmkt ePrinter: All versions

HP Designjet T120 24-in Printer (2018 edition): All versions

HP Designjet T120 24-in Printer: All versions

HP Designjet T120 24-in ePrinter: All versions

HP DesignJet rugged case: All versions

HP PageWide Pro MFP 772dw: All versions

HP PageWide Pro MFP 772dn: All versions

HP PageWide Pro 750dw: All versions

HP PageWide Pro 750dn: All versions

HP PageWide Managed P75050dw: All versions

HP PageWide Managed P75050dn: All versions

HP PageWide Managed MFP P77760z: All versions

HP PageWide Managed MFP P77750z: All versions

HP PageWide Managed MFP P77740z: All versions

HP PageWide Managed MFP P77740dw: All versions

HP PageWide Managed MFP P77740dn: All versions

External links
https://support.hp.com/us-en/document/c06097712

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.


Latest bulletins with this vulnerability


Remote code execution vulnerabilities in HP Inkjet Printers