CVE-2020-28416

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-03 · updated 2026-06-17

Description

HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution.

Affected products

HP Officejet 250 Cz992A Firmware: before 40.11.1148 — fixed in 40.11.1148
HP Officejet 250C L9D57A Firmware: before 40.11.1148 — fixed in 40.11.1148
HP Officejet 252 N4L16C Firmware: before 40.11.1148 — fixed in 40.11.1148
HP Officejet 252C N4L18C Firmware: before 40.11.1148 — fixed in 40.11.1148
HP Officejet 258 N4L17A Firmware: before 40.11.1148 — fixed in 40.11.1148
HP Officejet 4650 E6G87A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 F1H96A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 F1H96B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 F1J03A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 F1J04A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 F9D37A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 K9V77A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4650 K9V85B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4651 K9V83B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4652 F1J02A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4652 F1J05B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4652 K9V84B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4654 F1J06B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4654 F1J07B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4654 K9V76A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4655 F1J00A Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4655 K9V82B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4656 K9V81B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4657 V6D27B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4657 V6D29B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4658 V6D28B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 4658 V6D30B Firmware: before 40.11.1122 — fixed in 40.11.1122
HP Officejet 5740 B9S76A Firmware: before 40.13.1176 — fixed in 40.13.1176
HP Officejet 5740 B9S78A Firmware: before 40.13.1176 — fixed in 40.13.1176
HP Officejet 5740 B9S79A Firmware: before 40.13.1176 — fixed in 40.13.1176

How to fix

Upgrade to a fixed version: HP Officejet 250 Cz992A Firmware 40.11.1148; HP Officejet 250C L9D57A Firmware 40.11.1148; HP Officejet 252 N4L16C Firmware 40.11.1148; HP Officejet 252C N4L18C Firmware 40.11.1148; HP Officejet 258 N4L17A Firmware 40.11.1148; HP Officejet 4650 E6G87A Firmware 40.11.1122; HP Officejet 4650 F1H96A Firmware 40.11.1122; HP Officejet 4650 F1H96B Firmware 40.11.1122; HP Officejet 4650 F1J03A Firmware 40.11.1122; HP Officejet 4650 F1J04A Firmware 40.11.1122; HP Officejet 4650 F9D37A Firmware 40.11.1122; HP Officejet 4650 K9V77A Firmware 40.11.1122. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-28416 or the next vulnerability affects your stack