Skip to content
Fencer Vulns
medium 6.3

CVE-2024-2209 json

HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code

published 2024-03-26 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-27168

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

Patch / fix

  • hp 26k70b_firmware 2349b, 2349c, 2349d
  • hp 297x1a_firmware 2349b, 2349c, 2349d
  • hp 2a9q5a_firmware 2349b, 2349c, 2349d
  • hp 26k72a_firmware 2349b, 2349c, 2349d
  • hp 26k69a_firmware 2349b, 2349c, 2349d
  • hp 26k70a_firmware 2349b, 2349c, 2349d
  • hp 26k71a_firmware 2349b, 2349c, 2349d
  • hp 26k68a_firmware 2349b, 2349c, 2349d
  • hp 26k67a_firmware 2349b, 2349c, 2349d
  • hp 3xv19a_firmware 2349b, 2349c, 2349d
  • hp 7fr52a_firmware 2349b, 2349c, 2349d
  • hp 7fr57a_firmware 2349b, 2349c, 2349d
  • hp 7fr53a_firmware 2349b, 2349c, 2349d
  • hp 7fr58a_firmware 2349b, 2349c, 2349d
  • hp 7fr61a_firmware 2349b, 2349c, 2349d
  • hp 5ar83a_firmware 2349b, 2349c, 2349d
  • hp 5ar84a_firmware 2349b, 2349c, 2349d
  • hp 5ar85a_firmware 2349b, 2349c, 2349d
  • hp 8rk11a_firmware 2349b, 2349c, 2349d
  • hp 3xv17a_firmware 2349b, 2349c, 2349d

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Affected products

  • HP, Inc. HP Printer Firmware Update Utility
  • hp_inc hp_printer_firmware_update_utility

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.