CVE-2025-43018 Overview
CVE-2025-43018 is an information disclosure vulnerability affecting certain HP LaserJet Pro printers. An unauthenticated remote attacker can query a vulnerable device's local address book and retrieve stored contact information without providing credentials. The flaw is categorized under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor and stems from missing authorization controls on the address book query interface. HP has published a security advisory covering affected models in the W1A28A through W1A82A product ranges.
Critical Impact
Unauthenticated network-based attackers can extract contact records (names, email addresses, fax numbers) directly from vulnerable HP LaserJet Pro printers, exposing data useful for phishing and social engineering campaigns.
Affected Products
- HP LaserJet Pro printers with firmware SKUs W1A75A, W1A76A, W1A77A, W1A78A, W1A79A, W1A80A, W1A81A, W1A82A
- HP LaserJet Pro printers with firmware SKUs W1A28A, W1A29A, W1A30A, W1A31A, W1A32A, W1A33A
- HP LaserJet Pro printers with firmware SKUs W1A34A, W1A35A, W1A38A
Discovery Timeline
- 2025-07-30 - CVE-2025-43018 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-43018
Vulnerability Analysis
The vulnerability resides in the network-accessible interface that exposes the local address book on affected HP LaserJet Pro printers. The device fails to enforce authentication when responding to address book queries, allowing any client with network reachability to enumerate stored contact entries. The flaw is exploitable over the network without user interaction and without prior privileges on the device.
Address books on multifunction printers typically store recipient names, email addresses, fax numbers, and SMB share credentials used for scan-to-folder workflows. Disclosure of this data provides attackers with reconnaissance material for targeted phishing, business email compromise, and lateral movement into file shares referenced by the printer.
Root Cause
The root cause is a missing authorization check on the address book query handler. The device treats address book read requests as public rather than restricting them to authenticated administrators. This design flaw maps to [CWE-200] and reflects an insecure default configuration on the affected firmware builds.
Attack Vector
An attacker sends a crafted query to the printer's management interface over the network. No authentication, session, or user interaction is required. The device returns address book entries in its response. The attack requires only network reachability to the printer's management service, making internet-exposed or flat-network deployments most at risk. Refer to the HP Security Advisory for protocol-level details.
Detection Methods for CVE-2025-43018
Indicators of Compromise
- Unauthenticated HTTP or IPP requests to printer management endpoints originating from unexpected source hosts or subnets.
- Bursts of address book or contact-list queries against HP LaserJet Pro devices in short time windows.
- Outbound phishing emails referencing contacts that only exist inside printer address books.
Detection Strategies
- Inspect printer web server access logs for requests to address book resources from clients that are not administrative workstations.
- Deploy network monitoring rules to alert on unauthenticated queries to TCP ports used by the printer's embedded web server and management APIs.
- Correlate printer network activity with identity telemetry to detect address book access from non-administrative accounts or unmanaged hosts.
Monitoring Recommendations
- Enable and forward printer syslog and access logs to a centralized logging platform for retention and correlation.
- Baseline normal management traffic to each printer and alert on deviations in source, volume, or request path.
- Review firmware inventory regularly and flag HP LaserJet Pro devices running versions listed in the HP advisory.
How to Mitigate CVE-2025-43018
Immediate Actions Required
- Apply the firmware update referenced in the HP Security Advisory to all affected LaserJet Pro models.
- Remove printers from direct internet exposure and place them on a dedicated management VLAN with restricted ingress.
- Audit address book contents and rotate any credentials stored for scan-to-folder or scan-to-email workflows.
Patch Information
HP has released firmware updates for the affected LaserJet Pro SKUs. Administrators should consult the vendor advisory at HP Security Advisory hpsbpi04040 to identify the fixed firmware version for each product number and deploy the update through HP Web Jetadmin, the device's Embedded Web Server, or the printer's automatic update feature.
Workarounds
- Restrict inbound access to printer management ports using firewall or ACL rules, permitting only authorized administrative subnets.
- Disable remote management interfaces on printers that do not require them and require authentication on all remaining services.
- Clear or minimize address book entries on affected devices until the firmware update is applied.
# Example firewall rule restricting printer management access to an admin subnet
iptables -A FORWARD -s 10.10.50.0/24 -d 10.20.30.40 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.20.30.40 -p tcp --dport 443 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
