In a quest to hone their skills by analyzing a HP multifunction printer (MFP), cybersecurity researchers have encountered a couple of bugs that can be exploited to gain remote code execution rights.
According to the researchers, the vulnerabilities, tracked as CVE-2021-39237 and CVE-2021-39238, exist in the unit’s communications board and font parser. Worryingly, they date back to at least 2013, and affect a large number of printers in HP’s stable.
“There are a few things attackers could accomplish by exploiting these flaws in the way we’ve described. These vulnerabilities give attackers an effective way to steal information: defenders are unlikely to proactively examine the security of a printer, and so the attacker can simply sit back and steal whatever information it comes across (via employees printing, scanning, etc),” the researchers shared in a FAQ.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Furthermore, the researchers note that the bugs could enable the attackers to use the compromised MFP as an entry point to move through the corporate network.
Protecting printers
The researchers have used the opportunity to emphasize how organizations make themselves vulnerable to attacks by not treating printers as just another endpoint, leaving them unprotected, and oftentimes bereft of crucial updates.
Furthermore, the researchers argue that the situation isn’t helped by a lack of forensic tools that can recover evidence from MFPs and similar devices. This helps attackers exploit bugs such as the ones that they’ve discovered, while leaving little evidence of their malicious activities.
Although HP has patched the issues, the researchers have also shared ways to help organizations secure vulnerable MFPs.
For starters, organizations should keep the USB printing option disabled to limit physical use of the device. Secondly, the researchers recommend that network printers be placed in a separate, firewalled VLAN.
Instead of allowing computers in the network to communicate with the printers directly, they should instead interface with a dedicated print server, which should be the only point of communication to the printer.
Batten down the hatches with the help of these best firewall apps and services, and ensure your computers are protected with these best endpoint protection tools.
