Directory traversal vulnerability in the HP JetDirect web administration interface in the…
Priority MEDIUM 44CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Complete · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.
Summary
Directory traversal vulnerability in the HP JetDirect web administration interface in the HP-ChaiSOE 1.0 embedded web server on the LaserJet 9040mfp, LaserJet 9050mfp, and Color LaserJet 9500mfp before firmware 08.110.9; LaserJet 4345mfp and 9200C Digital Sender before firmware 09.120.9; Color LaserJet 4730mfp before firmware 46.200.9; LaserJet 2410, LaserJet 2420, and LaserJet 2430 before firmware 20080819 SPCL112A; LaserJet 4250 and LaserJet 4350 before firmware 20080819 SPCL015A; and LaserJet 9040 and LaserJet 9050 before firmware 20080819 SPCL110A allows remote attackers to read arbitrary files via directory traversal sequences in the URI.
Why it matters now
EPSS 0.07395 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:hp:9200c_digital_sender:*:*:*:*:*:*:*:* | up to 20081211_09.131.1 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_4370mfp:*:*:*:*:*:*:*:* | up to 20081211_46.211.2 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_9500mfp:*:*:*:*:*:*:*:* | up to 20070719_05.011.2 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_2410:*:*:*:*:*:*:*:* | up to 20070410_08.112.3 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_2420:*:*:*:*:*:*:*:* | up to 20070410_08.112.3 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_2430:*:*:*:*:*:*:*:* | up to 20070410_08.112.3 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_4250:*:*:*:*:*:*:*:* | up to 20080319_08.015.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_4345mfp:*:*:*:*:*:*:*:* | up to 20081211_09.131.1 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_4350:*:*:*:*:*:*:*:* | up to 20080319_08.015.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_9040:*:*:*:*:*:*:*:* | up to 20080204_08.110.0 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:h:hp:9200c_digital_sender:*:*:*:*:*:*:*:* Versions up to 20081211_09.131.1 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_4370mfp:*:*:*:*:*:*:*:* Versions up to 20081211_46.211.2 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_9500mfp:*:*:*:*:*:*:*:* Versions up to 20070719_05.011.2 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_2410:*:*:*:*:*:*:*:* Versions up to 20070410_08.112.3 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_2420:*:*:*:*:*:*:*:* Versions up to 20070410_08.112.3 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_2430:*:*:*:*:*:*:*:* Versions up to 20070410_08.112.3 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_4250:*:*:*:*:*:*:*:* Versions up to 20080319_08.015.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_4345mfp:*:*:*:*:*:*:*:* Versions up to 20081211_09.131.1 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_4350:*:*:*:*:*:*:*:* Versions up to 20080319_08.015.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_9040:*:*:*:*:*:*:*:* Versions up to 20080204_08.110.0 Vulnerable ·Hewlett Packard Enterprise
Show 3 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:hp:laserjet_9040mfp:*:*:*:*:*:*:*:* | up to 20080204_08.110.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_9050:*:*:*:*:*:*:*:* | up to 20080204_08.110.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:laserjet_9050mfp:*:*:*:*:*:*:*:* | up to 20080204_08.110.0 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:h:hp:laserjet_9040mfp:*:*:*:*:*:*:*:* Versions up to 20080204_08.110.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_9050:*:*:*:*:*:*:*:* Versions up to 20080204_08.110.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:laserjet_9050mfp:*:*:*:*:*:*:*:* Versions up to 20080204_08.110.0 Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-4419
- 2026-10-03 Alias added: GHSA-v7mr-5v8g-8mff
References
Advisory 1
Other 1
More Hewlett Packard Enterprise 9200c Digital Sender vulnerabilities
- TI-2009-00895 The HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital… CVSS 2.0HIGH 7.6
- TI-2009-00894 Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server… CVSS 2.0MEDIUM 5.1
Sources
- CVE-2008-4419 · CVE Program
- CVE-2008-4419 · NVD
- FIRST EPSS
- GHSA-v7mr-5v8g-8mff · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences