CVE-2011-4161 in the critical feed json
The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise C…
published 2011-12-01 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4104
- cvss
- 10.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.1%
- EPSS 14.1% chance of exploitation in 30 days, percentile 96%
- public exploits
- 0
- none known
Summary
The default configuration of the HP CM8060 Color MFP with Edgeline; Color LaserJet 3xxx, 4xxx, 5550, 9500, CMxxxx, CPxxxx, and Enterprise CPxxxx; Digital Sender 9200c and 9250c; LaserJet 4xxx, 5200, 90xx, Mxxxx, and Pxxxx; and LaserJet Enterprise 500 color M551, 600, M4555 MFP, and P3015 enables the Remote Firmware Update (RFU) setting, which allows remote attackers to execute arbitrary code by using a session on TCP port 9100 to upload a crafted firmware update.
Exploit prediction
14.15% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
h20000.www2.hp.com
/bizsupport/TechSupport/Document.jsp?objectID=c03102449
vendor-advisory
-
kb.cert.org
/vuls/id/717921
third-party-advisory, us-government-resource
- isc.sans.org /diary/Hacking+HP+Printers+for+Fun+and+Profit/12112
- redtape.msnbc.msn.com /_news/2011/11/29/9076395-exclusive-millions-of-printers-open-to-devastating-hack-attack-researchers-say
-
secunia.com
/advisories/47063
third-party-advisory
-
securitytracker.com
/id?1026357
vdb-entry
-
securityfocus.com
/bid/51324
vdb-entry
-
lists.immunityinc.com
/pipermail/dailydave/2011-November/000378.html
mailing-list
Sources
- CVE List CVE-2011-4161
- NVD CVE-2011-4161
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.