Improper privilege management in HP Color LaserJet Pro MFP M277 printers
Priority LOW 34CWE-269Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
A potential security vulnerability has been identified for HP LaserJet Solution Software (for certain HP LaserJet Printers) which may lead to unauthorized elevation of privilege on the client.
Why it matters now
EPSS 0.00249 16th percentileScored 2026-11-07
Fix Fixed HP Color LaserJet Pro MFP M277 printers: 14.0.15344.534
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HP Color LaserJet Pro MFP M277 printers | before 14.0.15344.534 | 14.0.15344.534 | Patch available | CNA |
- HP Color LaserJet Pro MFP M277 printers Vendor— Affected before 14.0.15344.534 Fixed in 14.0.15344.534 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q11a_firmware:*:*:*:*:*:*:*:* | 14.0.15344.534 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q11a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q11v_firmware:*:*:*:*:*:*:*:* | 14.0.15344.534 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q11v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q10a_firmware:*:*:*:*:*:*:*:* | 14.0.15344.534 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q10a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q10v_firmware:*:*:*:*:*:*:*:* | 14.0.15344.534 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q10v:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q17a_firmware:*:*:*:*:*:*:*:* | 14.0.15344.534 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q17a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q11a_firmware:*:*:*:*:*:*:*:* Versions 14.0.15344.534 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q11a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q11v_firmware:*:*:*:*:*:*:*:* Versions 14.0.15344.534 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q11v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q10a_firmware:*:*:*:*:*:*:*:* Versions 14.0.15344.534 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q10a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q10v_firmware:*:*:*:*:*:*:*:* Versions 14.0.15344.534 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q10v:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:color_laserjet_pro_mfp_m277_b3q17a_firmware:*:*:*:*:*:*:*:* Versions 14.0.15344.534 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:color_laserjet_pro_mfp_m277_b3q17a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
Remediation
- Fix · CNA HP Color LaserJet Pro MFP M277 printers Fixed in 14.0.15344.534
Timeline
- 2026-10-02 Threatist record created from CVE-2019-18916
- 2026-10-03 Alias added: GHSA-47jw-gpgj-9ccg
References
More Hewlett Packard Enterprise Color Laserjet Pro Mfp M277 B3q10a Firmware vulnerabilities
- TI-2021-02846 Memory corruption in Hewlett Packard Enterprise HP Print products and Digital Sending… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-18916 · CVE Program
- CVE-2019-18916 · NVD
- FIRST EPSS
- GHSA-47jw-gpgj-9ccg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences