CVE-2019-6325

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-06-17 · updated 2026-06-17
Weakness: CWE-352

Description

HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419), HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server that is potentially vulnerable to Cross-site Request Forgery.

Affected products

HP T6B80A Firmware: before 2019-04-19 — fixed in 2019-04-19
HP T6B81A Firmware: before 2019-04-19 — fixed in 2019-04-19
HP T6B82A Firmware: before 2019-04-19 — fixed in 2019-04-19
HP T6B83A Firmware: before 2019-04-19 — fixed in 2019-04-19
HP W2G54A Firmware: before 2019-04-26 — fixed in 2019-04-26
HP W2G55A Firmware: before 2019-04-26 — fixed in 2019-04-26
HP Y5S50A Firmware: before 2019-04-26 — fixed in 2019-04-26
HP Y5S53A Firmware: before 2019-04-26 — fixed in 2019-04-26
HP Y5S54A Firmware: before 2019-04-26 — fixed in 2019-04-26
HP Y5S55A Firmware: before 2019-04-26 — fixed in 2019-04-26

How to fix

Upgrade to a fixed version: HP T6B80A Firmware 2019-04-19; HP T6B81A Firmware 2019-04-19; HP T6B82A Firmware 2019-04-19; HP T6B83A Firmware 2019-04-19; HP W2G54A Firmware 2019-04-26; HP W2G55A Firmware 2019-04-26; HP Y5S50A Firmware 2019-04-26; HP Y5S53A Firmware 2019-04-26; HP Y5S54A Firmware 2019-04-26; HP Y5S55A Firmware 2019-04-26. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6325 or the next vulnerability affects your stack