NetSight
IP …
medium5.1

CVE-2009-0940

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders …

Impact

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.

Affected products

VendorProductAffected versions
Hp8100c Digital Sender
All versions
Hp9100c Digital Sender
All versions
Hp9200c Digital Sender
All versions
Hp9250c Digital Sender
All versions
HpColor Laserjet
All versions
HpColor Laserjet 1500
All versions
HpColor Laserjet 2500
All versions
HpColor Laserjet 2500l
All versions
HpColor Laserjet 2500lse
All versions
HpColor Laserjet 2500n
All versions
HpColor Laserjet 2500tn
All versions
HpColor Laserjet 2605dtn
All versions

Weakness classification

CWE-352

References