Vulnerability in HP Color Laserjet 3000
CVE-2012-5221
Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4345, M50xx, M90xx, P3005, and P4xxx; LaserJet Enterprise P3015; Color LaserJet 3xxx, 47xx, 5550, 9500, CM60xx, CP35xx, CP4005, and CP6015; Color LaserJet Enterprise CP4xxx; and 9250c Digital Sender with model-dependent firmware through 52.x allows remote attackers to read arbitrary files via unknown vectors.
Published · last modified .
CVSS v2 metric
CVSS v2 base score 5.0 (Medium). Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.039 (89.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 90th percentile — 89.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.039 · newest: 0.039 · change: 0.000
Affected products
- HP Color Laserjet 3000 — versions q7534a
- HP Color Laserjet 3800 — versions q5981a
- HP Color Laserjet 4700 — versions q7492a
- HP Color Laserjet 4730 Mfp — versions cb480a
- HP Color Laserjet 5550 — versions q3714a
- HP Color Laserjet 9500 Mfp — versions c8549a
- HP Color Laserjet Cm6030 Mfp — versions ce664a
- HP Color Laserjet Cm6040 Mfp — versions q3939a
- HP Color Laserjet Cp3505 — versions cb442a
- HP Color Laserjet Cp3525 — versions cc469a
Public proof-of-concept exploits
References
- h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay (Vendor Advisory, vendor-advisory)
- www.verisigninc.com/en_US/products-and-services/network-intelligence-availabili… (third-party-advisory)
Frequently asked questions
- What is CVE-2012-5221?
- CVE-2012-5221 is a vulnerability in HP Color Laserjet 3000. Published 2013-04-29.
- Is CVE-2012-5221 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.