CVE-2018-5921

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-03 · updated 2026-06-17
Weakness: CWE-352

Description

A potential security vulnerability has been identified with certain HP printers and MFPs in 2405129_000052 and other firmware versions. This vulnerability is known as Cross Site Request Forgery, and could potentially be exploited remotely to allow elevation of privilege.

Affected products

HP A2W75A Firmware: before 2405129_000054 — fixed in 2405129_000054
HP A2W76A Firmware: before 2405129_000054 — fixed in 2405129_000054
HP A2W77A Firmware: before 2405129_000057 — fixed in 2405129_000057
HP A2W78A Firmware: before 2405129_000057 — fixed in 2405129_000057
HP A2W79A Firmware: before 2405129_000057 — fixed in 2405129_000057
HP B3G84A Firmware: before 2405129_000040 — fixed in 2405129_000040
HP B3G85A Firmware: before 2405129_000040 — fixed in 2405129_000040
HP B3G86A Firmware: before 2405129_000040 — fixed in 2405129_000040
HP B5L04A Firmware: before 2405129_000050 — fixed in 2405129_000050
HP B5L05A Firmware: before 2405129_000050 — fixed in 2405129_000050
HP B5L06A Firmware: before 2405129_000050 — fixed in 2405129_000050
HP B5L07A Firmware: before 2405129_000050 — fixed in 2405129_000050
HP B5L26A Firmware: before 2405129_000056 — fixed in 2405129_000056
HP B5L39A Firmware: before 2405129_000056 — fixed in 2405129_000056
HP B5L46A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP B5L47A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP B5L48A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP B5L49A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP B5L50A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP B5L54A Firmware: before 2405129_000038 — fixed in 2405129_000038
HP C2S11A Firmware: before 2405129_000055 — fixed in 2405129_000055
HP C2S11V Firmware: before 2405129_000055 — fixed in 2405129_000055
HP C2S12A Firmware: before 2405129_000055 — fixed in 2405129_000055
HP C2S12V Firmware: before 2405129_000055 — fixed in 2405129_000055
HP Ca251A Firmware: before 2405129_000042 — fixed in 2405129_000042
HP Cc522A Firmware: before 2405135_000405 — fixed in 2405135_000405
HP Cc523A Firmware: before 2405135_000405 — fixed in 2405135_000405
HP Cc524A Firmware: before 2405135_000405 — fixed in 2405135_000405
HP Cd644A Firmware: before 2405135_000409 — fixed in 2405135_000409
HP Cd645A Firmware: before 2405135_000409 — fixed in 2405135_000409

How to fix

Upgrade to a fixed version: HP A2W75A Firmware 2405129_000054; HP A2W76A Firmware 2405129_000054; HP A2W77A Firmware 2405129_000057; HP A2W78A Firmware 2405129_000057; HP A2W79A Firmware 2405129_000057; HP B3G84A Firmware 2405129_000040; HP B3G85A Firmware 2405129_000040; HP B3G86A Firmware 2405129_000040; HP B5L04A Firmware 2405129_000050; HP B5L05A Firmware 2405129_000050; HP B5L06A Firmware 2405129_000050; HP B5L07A Firmware 2405129_000050. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-5921 or the next vulnerability affects your stack