CVE-2024-2209

MEDIUM

HP Printer Firmware < 2349b - Authenticated DLL Hijacking via Firmware Update Utility

Title source: llm
STIX 2.1

Description

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

References (1)

Core 1

Scores

CVSS v3 6.3
EPSS 0.0006
EPSS Percentile 20.0%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (28)
hp/26k67a_firmware < 2349b
hp/26k67b_firmware < 2349c
hp/26k68a_firmware < 2349b
hp/26k68b_firmware < 2349c
hp/26k69a_firmware < 2349b
hp/26k70a_firmware < 2349b
hp/26k70b_firmware < 2349b
hp/26k71a_firmware < 2349b
hp/26k72a_firmware < 2349b
hp/26k72b_firmware < 2349c
... and 18 more
Published Mar 27, 2024
Tracked Since Feb 18, 2026