Skip to content
Fencer Intel
medium 6.3

CVE-2024-2209 json

HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code

published 2y ago modified 4mo ago also EUVD-2024-27168

cvss
6.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.

Patch / fix

  • hp 26k70b_firmware 2349b, 2349c, 2349d
  • hp 297x1a_firmware 2349b, 2349c, 2349d
  • hp 2a9q5a_firmware 2349b, 2349c, 2349d
  • hp 26k72a_firmware 2349b, 2349c, 2349d
  • hp 26k69a_firmware 2349b, 2349c, 2349d
  • hp 26k70a_firmware 2349b, 2349c, 2349d
  • hp 26k71a_firmware 2349b, 2349c, 2349d
  • hp 26k68a_firmware 2349b, 2349c, 2349d
  • hp 26k67a_firmware 2349b, 2349c, 2349d
  • hp 3xv19a_firmware 2349b, 2349c, 2349d
  • hp 7fr52a_firmware 2349b, 2349c, 2349d
  • hp 7fr57a_firmware 2349b, 2349c, 2349d
  • hp 7fr53a_firmware 2349b, 2349c, 2349d
  • hp 7fr58a_firmware 2349b, 2349c, 2349d
  • hp 7fr61a_firmware 2349b, 2349c, 2349d
  • hp 5ar83a_firmware 2349b, 2349c, 2349d
  • hp 5ar84a_firmware 2349b, 2349c, 2349d
  • hp 5ar85a_firmware 2349b, 2349c, 2349d
  • hp 8rk11a_firmware 2349b, 2349c, 2349d
  • hp 3xv17a_firmware 2349b, 2349c, 2349d

Is CVE-2024-2209 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L
CNA 3.1 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Affected products

  • HP, Inc. HP Printer Firmware Update Utility
  • hp_inc hp_printer_firmware_update_utility

Classification

Weakness
  • CWE-94 Improper Control of Generation of Code

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.