Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color…
Priority LOW 30Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Directory traversal vulnerability in the HP Color LaserJet 2500 Toolbox and Color LaserJet 4600 Toolbox on Microsoft Windows before 20060402 allows remote attackers to read arbitrary files via a .. (dot dot) in an HTTP GET request to TCP port 5225.
Why it matters now
EPSS 0.04751 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:color_laserjet_2500_toolbox:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:color_laserjet_4600_toolbox:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet:4600dn:*:*:*:*:*:*:* | 4600dn | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet:4600dtn:*:*:*:*:*:*:* | 4600dtn | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet:4600hdn:*:*:*:*:*:*:* | 4600hdn | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_2500:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_2500l:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_2500lse:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_2500n:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_2500tn:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:color_laserjet_2500_toolbox:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:color_laserjet_4600_toolbox:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet:4600dn:*:*:*:*:*:*:* Versions 4600dn Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet:4600dtn:*:*:*:*:*:*:* Versions 4600dtn Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet:4600hdn:*:*:*:*:*:*:* Versions 4600hdn Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_2500:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_2500l:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_2500lse:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_2500n:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_2500tn:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
Show 1 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:hp:color_laserjet_4600:*:*:*:*:*:*:*:* | all versions | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:h:hp:color_laserjet_4600:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2006-1654
- 2026-10-03 Alias added: GHSA-5hc7-j537-3jg8
References
More Hewlett Packard Enterprise Color Laserjet vulnerabilities
- TI-2009-00895 The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital… CVSS 2.0HIGH 7.6
- TI-2004-02309 The remote upgrade capability in HP LaserJet 4200 and 4300 printers does not require a… CVSS 2.0MEDIUM 5.0
- TI-2009-00894 Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server… CVSS 2.0MEDIUM 5.1
Sources
- CVE-2006-1654 · CVE Program
- CVE-2006-1654 · NVD
- FIRST EPSS
- GHSA-5hc7-j537-3jg8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences