CVE-2024-2301: HP LaserJet Pro XSS Vulnerability

CVE-2024-2301 Overview

CVE-2024-2301 is a Cross-Site Scripting (XSS) vulnerability affecting the web management interface of certain HP LaserJet Pro devices. The flaw is classified under [CWE-79], improper neutralization of input during web page generation. An authenticated attacker with low privileges can inject malicious script content that executes in the browser of a user interacting with the device's management interface. Because the vulnerability has a scope change component, the impact can extend beyond the printer's web application boundary. HP acknowledged the issue in security bulletin hpsbpi03940 and published mitigation guidance for the affected LaserJet Pro models.

Critical Impact
Successful exploitation allows attackers to execute arbitrary script in the context of an administrator's session, potentially leading to configuration tampering, session hijacking, and disclosure of sensitive printer data.

Affected Products

HP LaserJet Pro devices with firmware for models CZ172A, CZ173A, CZ174A, CZ175A, CZ176A, CZ177A, CZ178A
HP LaserJet Pro devices with firmware for models CZ181A, CZ182A, CZ183A, CZ184A, CZ185A, CZ186A, CZ187A
Associated device firmware images identified in HP security bulletin hpsbpi03940

Discovery Timeline

2024-05-23 - CVE-2024-2301 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2301

Vulnerability Analysis

The vulnerability resides in the embedded web server (EWS) that HP LaserJet Pro devices expose for administration. One or more input fields accessible through the web management interface fail to properly neutralize script content before rendering it back in HTTP responses. When an attacker submits a crafted payload containing HTML or JavaScript, the printer stores or reflects that content, and the browser of a subsequent visitor executes it.

Exploitation requires an authenticated session with low privileges and user interaction from another operator, such as an administrator viewing a settings or log page. The scope-changed impact means script executes with access to resources outside the vulnerable component's original security context, including cookies, tokens, and forms belonging to the administrator's browsing session.

Root Cause

The root cause is missing or insufficient output encoding on data supplied to the web management interface. User-controlled fields are inserted directly into HTML responses without contextual escaping. Because the firmware treats the submitted content as trusted, standard XSS defenses such as HTML entity encoding, attribute quoting, and Content Security Policy enforcement are not applied consistently.

Attack Vector

The attack is network-based and does not require physical access to the device. An attacker who has obtained low-privileged credentials, or who can reach a printer that exposes weakly protected administrative endpoints, submits a payload through a vulnerable input field. When an administrator later opens the affected page, the injected script executes with the privileges of that administrator, allowing the attacker to change printer settings, harvest credentials entered into the interface, or pivot to internal resources reachable from the administrator's workstation.

No public proof-of-concept exploit is currently listed for this CVE, and it is not present on the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-2301

Indicators of Compromise

Unexpected <script>, onerror=, or javascript: strings stored in printer configuration fields visible through the EWS
Outbound HTTP requests originating from administrator workstations to unknown hosts immediately after visiting a printer management page
Unauthorized changes to printer configuration, address books, or SNMP community strings following administrator logins

Detection Strategies

Inspect HTTP traffic to and from printer management interfaces for payloads containing script tags or event handler attributes in POST request bodies
Review printer EWS logs, where available, for repeated failed or successful writes to configuration fields by low-privileged accounts
Correlate authentication events on printers with subsequent administrator sessions to identify possible stored-XSS trigger paths

Monitoring Recommendations

Restrict access to printer management interfaces to a dedicated administrative VLAN and monitor that segment for anomalous HTTP activity
Alert on any first-time access to printer IP addresses from non-administrative endpoints
Track firmware versions across the HP LaserJet Pro fleet and flag devices that lag behind the vendor-recommended baseline

How to Mitigate CVE-2024-2301

Immediate Actions Required

Apply the firmware updates referenced in the HP Security Bulletin hpsbpi03940 to all affected LaserJet Pro models
Change default and shared administrative credentials on every printer and enforce unique passwords per device
Remove printer management interfaces from any internet-facing network segment and restrict access to authorized administrators only

Patch Information

HP has released updated firmware for the affected LaserJet Pro CZ17x and CZ18x series devices. Refer to the HP Security Bulletin for the specific firmware versions and download links applicable to each model. Administrators should validate the installed firmware version through the EWS or HP Web Jetadmin after updating.

Workarounds

Disable the embedded web server on devices that do not require remote administration, using the printer control panel or HP Web Jetadmin policies
Place printers behind a network access control list that only permits management traffic from administrator jump hosts
Require administrators to use isolated browser profiles or dedicated workstations when accessing printer management interfaces to limit session token exposure

bash

# Example: restrict access to the printer EWS to a management subnet using an upstream firewall rule
# Replace 192.0.2.0/24 with your administrative subnet and 10.10.20.15 with the printer IP
iptables -A FORWARD -p tcp -d 10.10.20.15 --dport 443 -s 192.0.2.0/24 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.20.15 --dport 443 -j DROP
iptables -A FORWARD -p tcp -d 10.10.20.15 --dport 80  -j DROP