Cross-site scripting in Hewlett Packard Enterprise Certain HP LaserJet Pro Devices
Priority LOW 33CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting (XSS) attack via the web management interface of the device.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00298 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | Certain HP LaserJet Pro Devices | See HP Security Bulletin reference for affected versions. | — | No fix listed | CNA |
- Certain HP LaserJet Pro Devices VendorHewlett Packard Enterprise Affected See HP Security Bulletin reference for affected versions. Fixed in — No fix listed CNA
CPE configurations NVD · 28
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:cz181a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz181a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz182a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz182a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz187a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz187a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz183a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz183a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz172a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz172a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:cz181a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz181a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz182a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz182a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz187a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz187a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz183a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz183a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz172a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz172a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
Show 18 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:cz173a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz173a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz176a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz176a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz177a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz177a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz178a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz178a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz174a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz174a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz175a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz175a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz184a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz184a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz185a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz185a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:cz186a_firmware:*:*:*:*:*:*:*:* | before 2023-03-30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:cz186a:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:cz173a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz173a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz176a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz176a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz177a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz177a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz178a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz178a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz174a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz174a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz175a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz175a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz184a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz184a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz185a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz185a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:cz186a_firmware:*:*:*:*:*:*:*:* Versions before 2023-03-30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:cz186a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-2301
- 2026-10-03 Alias added: GHSA-mww2-g4ww-rm9w
References
Sources
- CVE-2024-2301 · CVE Program
- CVE-2024-2301 · NVD
- FIRST EPSS
- GHSA-mww2-g4ww-rm9w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences