What’s Vulnerable › Vulnerabilities

CVE-2009-2684

• Severity: medium (CVSS 4.3 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2009-10-13 · updated 2026-06-16
• Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

Affected products

• HP Cm8050 Mfp: all versions
• HP Cm8060 Mfp: all versions
• HP Color Laserjet 3000N: all versions
• HP Color Laserjet 3600N: all versions
• HP Color Laserjet 3800N: all versions
• HP Color Laserjet 4700N: all versions
• HP Color Laserjet 4730 Mfp: all versions
• HP Color Laserjet 6040 Mfp: all versions
• HP Color Laserjet Cm4730 Mfp: all versions
• HP Color Laserjet Cp3505: all versions
• HP Color Laserjet Cp4005N: all versions
• HP Color Laserjet Cp6015: all versions
• HP Ds 9200C: all versions
• HP Ds 9250C: all versions
• HP Laserjet 2410: all versions
• HP Laserjet 2420: all versions
• HP Laserjet 2430N: all versions
• HP Laserjet 4240: all versions
• HP Laserjet 4250N: all versions
• HP Laserjet 4345 Mfp: all versions
• HP Laserjet 4350N: all versions
• HP Laserjet 5200N: all versions
• HP Laserjet 9040 Mfp: all versions
• HP Laserjet 9040N: all versions
• HP Laserjet 9050 Mfp: all versions
• HP Laserjet 9050N: all versions
• HP Laserjet M3027 Mfp: all versions
• HP Laserjet M3035 Mfp: all versions
• HP Laserjet M4345X Mfp: all versions
• HP Laserjet M5025 Mfp: all versions

References

• http://dsecrg.com/pages/vul/show.php?id=148
• http://marc.info/?l=bugtraq&m=125493484205823&w=2
• http://secunia.com/advisories/36969
• http://www.securityfocus.com/archive/1/507038/100/0/threaded
• http://www.securityfocus.com/bid/36613
• http://www.vupen.com/english/advisories/2009/2850
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
• http://dsecrg.com/pages/vul/show.php?id=148
• http://marc.info/?l=bugtraq&m=125493484205823&w=2
• http://secunia.com/advisories/36969
• http://www.securityfocus.com/archive/1/507038/100/0/threaded
• http://www.securityfocus.com/bid/36613

Get alerted when CVE-2009-2684 or the next vulnerability affects your stack