TI-2019-13638 Aliases CVE-2019-18917 GHSA-qxhc-pj82-j93c

Missing brute-force protection in HP ENVY 5000 All-in-One Printer series ; HP DeskJet Ink…

LOW 32CWE-307Published 2020-03-16 · Updated 2024-08-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

A potential security vulnerability has been identified for certain HP Printers and All-in-Ones that would allow bypassing account lockout.

Why it matters now

EPSS 0.01475 73rd percentileScored 2026-11-07

Fix Fixed HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B): 003.2008A

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B)	before 003.2008A	003.2008A	Patch available	CNA

HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B) Vendor— Affected before 003.2008A Fixed in 003.2008A Patch available CNA

CPE configurations NVD · 16

CPE	Versions	Role	Vendor
cpe:2.3:o:hp:envy_5000_m2u85a_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u85a:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u85b_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u85b:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u91a_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u91a:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u94b_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u94b:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_z4a54a_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_z4a54a:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise

cpe:2.3:o:hp:envy_5000_m2u85a_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u85a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u85b_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u85b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u91a_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u91a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_m2u94b_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_m2u94b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:envy_5000_z4a54a_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_z4a54a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise

Show 6 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:o:hp:envy_5000_z4a74a_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_z4a74a:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:deskjet_ink_advantage_5000_m2u86a_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:deskjet_ink_advantage_5000_m2u86a:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise
cpe:2.3:o:hp:deskjet_ink_advantage_5000_m2u89b_firmware::::::::	before 003.2008a	Vulnerable	Hewlett Packard Enterprise
cpe:2.3:h:hp:deskjet_ink_advantage_5000_m2u89b:-:::::::*	not specified by NVD	Running on	Hewlett Packard Enterprise

cpe:2.3:o:hp:envy_5000_z4a74a_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:envy_5000_z4a74a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:deskjet_ink_advantage_5000_m2u86a_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:deskjet_ink_advantage_5000_m2u86a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
cpe:2.3:o:hp:deskjet_ink_advantage_5000_m2u89b_firmware:*:*:*:*:*:*:*:* Versions before 003.2008a Vulnerable ·Hewlett Packard Enterprise
cpe:2.3:h:hp:deskjet_ink_advantage_5000_m2u89b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise

Remediation

Fix · CNA HP ENVY 5000 All-in-One Printer series (M2U85A - M2U85B, M2U91A - M2U94B, Z4A54A - Z4A74A); HP DeskJet Ink Advantage 5000 All-in-One Printer series (M2U86A - M2U89B) Fixed in 003.2008A

Timeline

2026-10-02 Threatist record created from CVE-2019-18917
2026-10-03 Alias added: GHSA-qxhc-pj82-j93c

References

Advisory 1

https://support.hp.com/us-en/document/c06594863

TI-2019-04498 Cross-site scripting in Hewlett Packard Enterprise HP DeskJet 2600 All-in-One Printer… CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences