What is CVE-2024-2209?

CVE-2024-2209 is a medium-severity vulnerability in Hp 26k67a, classified under Code Injection. CVSS score: 6.3/10. Published 2024-03-27.

How severe is CVE-2024-2209?

Medium severity. CVSS v3 base score is 6.3 out of 10.

RCE in Hp 26k67a

CVE-2024-2209

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.002 (11.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L.

Affected products

Hp 26k67a
Hp 26k67a_firmware
Hp 26k67b
Hp 26k67b_firmware
Hp 26k68a
Hp 26k68a_firmware
Hp 26k68b
Hp 26k68b_firmware
Hp 26k69a
Hp 26k69a_firmware

Weakness classification (CWE)

CWE-94 — Code Injection

References

hp-security-alert@hp.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-2209?: CVE-2024-2209 is a medium-severity vulnerability in Hp 26k67a, classified under Code Injection. CVSS score: 6.3/10. Published 2024-03-27.
How severe is CVE-2024-2209?: Medium severity. CVSS v3 base score is 6.3 out of 10.