CVE-2019-18917

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-16 · updated 2026-06-17
Weakness: CWE-307

Description

A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.

Affected products

HP Deskjet Ink Advantage 5000 M2U86A Firmware: before 003.2008a — fixed in 003.2008a
HP Deskjet Ink Advantage 5000 M2U89B Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 M2U85A Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 M2U85B Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 M2U91A Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 M2U94B Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 Z4A54A Firmware: before 003.2008a — fixed in 003.2008a
HP Envy 5000 Z4A74A Firmware: before 003.2008a — fixed in 003.2008a

How to fix

Upgrade to a fixed version: HP Deskjet Ink Advantage 5000 M2U86A Firmware 003.2008a; HP Deskjet Ink Advantage 5000 M2U89B Firmware 003.2008a; HP Envy 5000 M2U85A Firmware 003.2008a; HP Envy 5000 M2U85B Firmware 003.2008a; HP Envy 5000 M2U91A Firmware 003.2008a; HP Envy 5000 M2U94B Firmware 003.2008a; HP Envy 5000 Z4A54A Firmware 003.2008a; HP Envy 5000 Z4A74A Firmware 003.2008a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-18917 or the next vulnerability affects your stack