CVE-2024-2209: HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-27 · updated 2026-06-17
Weakness: CWE-94

Description

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

Affected products

HP 26K67A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K67B Firmware: before 2349c; before 2349b; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K68A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K68B Firmware: before 2349c; before 2349b; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K69A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K70A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K70B Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K71A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K72A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 26K72B Firmware: before 2349c; before 2349b; before 2349d — fixed in 2349b, 2349c, 2349d
HP 297W8A Firmware: before 2349c; before 2349b; before 2349d — fixed in 2349b, 2349c, 2349d
HP 297X0A Firmware: before 2349c; before 2349b; before 2349d — fixed in 2349b, 2349c, 2349d
HP 297X1A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 2A9Q5A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 3Xv17A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 3Xv19A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 4Ws04A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 5Ar83A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 5Ar84A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 5Ar85A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr20A Firmware: before 2349b; before 2349c — fixed in 2349b, 2349c
HP 7Fr21A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr52A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr53A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr57A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr58A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 7Fr61A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d
HP 8Rk11A Firmware: before 2349b; before 2349c; before 2349d — fixed in 2349b, 2349c, 2349d

How to fix

Upgrade to a fixed version: HP 26K67A Firmware 2349b, 2349c, 2349d; HP 26K67B Firmware 2349b, 2349c, 2349d; HP 26K68A Firmware 2349b, 2349c, 2349d; HP 26K68B Firmware 2349b, 2349c, 2349d; HP 26K69A Firmware 2349b, 2349c, 2349d; HP 26K70A Firmware 2349b, 2349c, 2349d; HP 26K70B Firmware 2349b, 2349c, 2349d; HP 26K71A Firmware 2349b, 2349c, 2349d; HP 26K72A Firmware 2349b, 2349c, 2349d; HP 26K72B Firmware 2349b, 2349c, 2349d; HP 297W8A Firmware 2349b, 2349c, 2349d; HP 297X0A Firmware 2349b, 2349c, 2349d. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-2209 or the next vulnerability affects your stack