HP Plugs Leaky Password Hole Existing in Some of It’s Printers

Security flaws in a range of HP printers create a way for hackers to lift administrator’s passwords and other potentially sensitive information from vulnerable devices, infosec experts have warned.

HP has released patches for the affected LaserJet Pro printers to defend against the vulnerability (CVE-2013-4807), which was discovered by Michał Sajdak of Securitum.pl. Sajdak discovered it was possible to extract plaintext versions of users’ passwords via hidden URLs hardcoded into the printers’ firmware. A hex representation of the admin password is stored in a plaintext URL, though it looks encrypted to a casual observer.

Sajdak also discovered Wi-Fi-enabled printers leaked Wi-Fi settings and Wi-Fi Protected Setup PIN codes, as an advisory from the Polish security researcher explains.

HP has released firmware updates for the following affected printers:

  • HP LaserJet Pro P1102w,
  • HP LaserJet Pro P1606dn,
  • HP LaserJet Pro M1212nf MFP,
  • HP LaserJet Pro M1213nf MFP,
  • HP LaserJet Pro M1214nfh MFP,
  • HP LaserJet Pro M1216nfh MFP,
  • HP LaserJet Pro M1217nfw MFP,
  • HP LaserJet Pro M1218nfs MFP and
  • HP LaserJet Pro CP1025nw.

HP’s advisory is here.

Consumers aren’t very good at patching their computers, much less their printers, which rarely need security updates.

“The bad news is that many printer owners probably aren’t aware that the security issue exists, or simply won’t bother to apply the firmware update,” security watcher Graham Cluley notes. ®

original article