Finding HP printers and MFPs vulnerable to Printing Shellz
Do you have HP printers and multi-function printers (MFPs)? You might want to look at the two recently published vulnerabilities that affect 150+ models. Named “Printing Shellz” by the F-Secure security researchers who reported them, these vulns have been around for ~8 years.
When successfully exploited, can provide attackers with:
- CVE-2021-39237, “medium” CVSS score of 4.6 - Information disclosure via exposed connectors to gain shell access (requires physical access to the vulnerable device).
- CVE-2021-39238, “critical” CVSS score of 9.8 - Remote code execution via buffer overflow in the font parsing logic.
HP LaserJet, PageWide, OfficeJet, and ScanJet product lines all contain vulnerable models. You can find the full lists in HP’s posted advisories: CVE-2021-39237 and CVE-2021-39238.
HP released patched firmware last month and urged owners of affected printers to update their firmware as soon as possible. F-Secure’s researchers also offer some mitigation strategies, as well in section 6 of their writeup.
How to find vulnerable HP printers and MFPs with runZero
From the Asset Inventory, use the following pre-built query to locate potentially vulnerable HP printer and MFP assets within your network:
NOT hardware:"JetDirect" AND (mac_vendor:"HP" OR mac_vendor:="Hewlett Packard%" OR hardware:"HP%" OR hardware:="Hewlett Packard%") AND (type:printer OR os.family:"LaserJet" OR NOT (os:"%iLO%" OR type:switch OR type:computer))

You can also search via the Service Inventory, using the following pre-built query to locate potentially HP printer and MFP services within your network:
_asset.protocol:http AND protocol:http AND ((html.title:="HP %LaserJet%" OR banner:="HP %LaserJet%") OR (html.title:="HP %PageWide%" OR banner:="HP %PageWide%") OR (html.title:="HP %OfficeJet%" OR banner:="HP %OfficeJet%") OR (html.title:="HP %ScanJet%" OR banner:="HP %ScanJet%"))

Note that results from the above queries may contain models that are not vulnerable, so manual verification against the full lists of affected models published by HP (here and here) is needed.
As always, any prebuilt queries we create are available from our Queries Library. Check out the library for other useful inventory queries.

Similar Content
June 3, 2023
Finding MOVEit File Transfer Services
Reports of active exploitation of a zero-day vulnerability in the MOVEit file transfer software are making the rounds this week. The vendor, Progress Software, has released an advisory and this issue has now been assigned CVE-2023-34362. Attackers are abusing a SQL injection …
Read MoreJune 2, 2023
Finding Barracuda Email Security Gateways
Exploitation of Barracuda Email Security Gateway (ESG) appliances has made the news recently, including on-going investigation into the attacks. Leveraging a zero-day vulnerability as far back as October 2022, attackers compromised ESG targets to deploy malware that created …
Read MoreMay 31, 2023
Finding Zyxel Network Devices
Last month, Zyxel disclosed a remote command execution vulnerability affecting a handful of their product families. This vulnerability has been assigned CVE-2023-28771, and with a CVSSv3 score of 9.8, this vulnerability is considered highly critical. Attackers who send a …
Read More