CVE-2024-5749 Overview
CVE-2024-5749 affects multiple HP DesignJet large-format printer models. The vulnerability allows an unauthenticated remote attacker to retrieve stored Simple Mail Transfer Protocol (SMTP) server credentials through credential reflection in the device's web interface. HP DesignJet devices typically store SMTP credentials to support scan-to-email and notification features, making these secrets a high-value target for lateral movement.
The issue maps to [CWE-306: Missing Authentication for Critical Function], with a network attack vector and no required user interaction. Successful exploitation reveals plaintext or recoverable credentials, enabling downstream attacks against corporate mail infrastructure.
Critical Impact
An unauthenticated network attacker can extract SMTP server credentials from affected HP DesignJet printers, exposing corporate email accounts to abuse and lateral movement.
Affected Products
- HP DesignJet firmware on models F9A29A, F9A29B, F9A29C, F9A29D, F9A29E, F9A29G
- HP DesignJet firmware on models F9A30A, F9A30B, F9A30C, F9A30D, F9A30E, F9A30G
- HP DesignJet firmware on models T5D66A, T5D67A, and 1JL02B
Discovery Timeline
- 2024-10-15 - CVE-2024-5749 published to the National Vulnerability Database (NVD)
- 2026-02-24 - Last updated in NVD database
Technical Details for CVE-2024-5749
Vulnerability Analysis
The vulnerability resides in the SMTP configuration workflow of the HP DesignJet embedded web server. When an administrator configures scan-to-email or notification features, the printer stores the SMTP username and password locally. When the configuration page is later accessed or queried, the device reflects the stored credential back to the client rather than masking it or requiring re-entry.
Because the affected endpoint lacks the authentication controls expected for a sensitive function, an attacker who can reach the printer over the network can request the SMTP configuration and recover the credential. Mail accounts used by printers are frequently shared service accounts, which amplifies the impact beyond a single device.
Root Cause
The root cause is missing authentication for a critical function, classified under [CWE-306]. The SMTP credential field is returned to the client in a form that allows recovery rather than being write-only or replaced with a placeholder. Combined with insufficient access control on the configuration endpoint, this design exposes stored secrets to any network-reachable requester.
Attack Vector
Exploitation requires only network reachability to the printer's management interface. The attacker issues HTTP requests against the SMTP configuration endpoint and parses the response to extract the credential. No user interaction, social engineering, or prior authentication is needed. Printers placed on flat corporate networks, or exposed to the internet through misconfiguration, are at highest risk.
No public proof-of-concept exploit is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the HP Security Bulletin for vendor-specific technical details.
Detection Methods for CVE-2024-5749
Indicators of Compromise
- Unexpected HTTP/HTTPS requests to printer management interfaces from non-administrative hosts targeting SMTP configuration paths.
- Outbound SMTP authentication attempts from new or unusual source IPs using credentials known to be configured on DesignJet devices.
- Mail server logs showing successful logins for printer service accounts from hosts other than the printer itself.
Detection Strategies
- Inventory all HP DesignJet devices and confirm firmware versions against the affected list in the HP Security Bulletin.
- Monitor management plane traffic to printers for unauthenticated access patterns against configuration endpoints.
- Correlate printer service-account SMTP authentication events with the originating IP to identify credential reuse outside the device.
Monitoring Recommendations
- Enable verbose logging on mail relays for service accounts associated with multifunction and large-format printers.
- Alert on any external or untrusted network access to printer web interfaces over TCP/80, TCP/443, or vendor-specific management ports.
- Periodically rotate SMTP credentials configured on printers and watch for authentication failures, which can indicate stale credentials still in use by an attacker.
How to Mitigate CVE-2024-5749
Immediate Actions Required
- Apply the firmware update referenced in the HP Security Bulletin to all affected DesignJet models.
- Rotate any SMTP credentials that were stored on affected printers, treating them as compromised until proven otherwise.
- Restrict management interface access to a dedicated administrative VLAN or jump host.
Patch Information
HP has published firmware updates and remediation guidance in security bulletin HPSBPI03979. Administrators should consult the bulletin to map their specific DesignJet model and serial range to the correct firmware version and apply the update through HP's standard firmware deployment process.
Workarounds
- Disable scan-to-email or SMTP notification features on affected printers until firmware can be applied.
- Place printers on a segmented network that blocks inbound connections from user workstations and the internet.
- Use a dedicated, least-privilege mail account for printer SMTP relay with sending rights only and strong monitoring.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
