HP Fixes Printer Password Hole

Friday, August 9, 2013 @ 04:08 PM gHale

HP patched the security problems in their printers that could create a way for hackers to lift administrator’s passwords and other potentially sensitive information from vulnerable devices.

It is now up the the users as HP released patches for the LaserJet Pro printers to defend against the vulnerability (CVE-2013-4807), discovered by Michał Sajdak of Securitum.pl.

Critical Hole in HP Printers
Networked Printers Open to Attack
Fix for VoIP Phone Vulnerabilities
Secure Communication Technology

Sajdak found it was possible to extract plaintext versions of users’ passwords via hidden URLs hardcoded into the printers’ firmware. A hex representation of the admin password is in a plaintext URL, though it looks encrypted to a casual observer.

Sajdak also discovered Wi-Fi-enabled printers leaked Wi-Fi settings and Wi-Fi Protected Setup PIN codes.

HP released firmware updates for the following affected printers:
• HP LaserJet Pro P1102w
• HP LaserJet Pro P1606dn
• HP LaserJet Pro M1212nf MFP
• HP LaserJet Pro M1213nf MFP
• HP LaserJet Pro M1214nfh MFP
• HP LaserJet Pro M1216nfh MFP
• HP LaserJet Pro M1217nfw MFP
• HP LaserJet Pro M1218nfs MFP
• HP LaserJet Pro CP1025nw

Consumers aren’t very good at patching their computers, much less their printers, which rarely need security updates.

Leave a Reply

You must be logged in to post a comment.