CVE-2023-35177

8.8 HIGH

Remote Code Execution Buffer Overflow

📋 TL;DR

This vulnerability in HP LaserJet Pro printers allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the compact font format parser. Attackers could potentially take full control of affected printers. Organizations using vulnerable HP LaserJet Pro models are affected.

💻 Affected Systems

Products:

• HP LaserJet Pro printers with specific firmware versions

Versions: Firmware versions prior to the fix released by HP

Operating Systems: Printer firmware only

Default Config Vulnerable: ⚠️ Yes

Notes: Affects printers with vulnerable firmware versions; requires network connectivity to exploit.

📦 What is this software?

Laserjet Pro M304 M305 W1a46a Firmware by Hp

View all CVEs affecting Laserjet Pro M304 M305 W1a46a Firmware →

Laserjet Pro M304 M305 W1a47a Firmware by Hp

View all CVEs affecting Laserjet Pro M304 M305 W1a47a Firmware →

Laserjet Pro M304 M305 W1a48a Firmware by Hp

View all CVEs affecting Laserjet Pro M304 M305 W1a48a Firmware →

Laserjet Pro M304 M305 W1a66a Firmware by Hp

View all CVEs affecting Laserjet Pro M304 M305 W1a66a Firmware →

Laserjet Pro M404 M405 93m22a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 93m22a Firmware →

Laserjet Pro M404 M405 W1a51a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a51a Firmware →

Laserjet Pro M404 M405 W1a52a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a52a Firmware →

Laserjet Pro M404 M405 W1a53a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a53a Firmware →

Laserjet Pro M404 M405 W1a56a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a56a Firmware →

Laserjet Pro M404 M405 W1a57a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a57a Firmware →

Laserjet Pro M404 M405 W1a58a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a58a Firmware →

Laserjet Pro M404 M405 W1a59a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a59a Firmware →

Laserjet Pro M404 M405 W1a60a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a60a Firmware →

Laserjet Pro M404 M405 W1a63a Firmware by Hp

View all CVEs affecting Laserjet Pro M404 M405 W1a63a Firmware →

Laserjet Pro M453 M454 W1y40a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y40a Firmware →

Laserjet Pro M453 M454 W1y41a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y41a Firmware →

Laserjet Pro M453 M454 W1y43a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y43a Firmware →

Laserjet Pro M453 M454 W1y44a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y44a Firmware →

Laserjet Pro M453 M454 W1y45a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y45a Firmware →

Laserjet Pro M453 M454 W1y46a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y46a Firmware →

Laserjet Pro M453 M454 W1y47a Firmware by Hp

View all CVEs affecting Laserjet Pro M453 M454 W1y47a Firmware →

Laserjet Pro Mfp M428 M429 F W1a29a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a29a Firmware →

Laserjet Pro Mfp M428 M429 F W1a30a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a30a Firmware →

Laserjet Pro Mfp M428 M429 F W1a32a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a32a Firmware →

Laserjet Pro Mfp M428 M429 F W1a34a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a34a Firmware →

Laserjet Pro Mfp M428 M429 F W1a35a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a35a Firmware →

Laserjet Pro Mfp M428 M429 F W1a38a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 F W1a38a Firmware →

Laserjet Pro Mfp M428 M429 W1a28a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 W1a28a Firmware →

Laserjet Pro Mfp M428 M429 W1a31a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 W1a31a Firmware →

Laserjet Pro Mfp M428 M429 W1a33a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M428 M429 W1a33a Firmware →

Laserjet Pro Mfp M478 M479 W1a75a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a75a Firmware →

Laserjet Pro Mfp M478 M479 W1a76a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a76a Firmware →

Laserjet Pro Mfp M478 M479 W1a77a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a77a Firmware →

Laserjet Pro Mfp M478 M479 W1a78a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a78a Firmware →

Laserjet Pro Mfp M478 M479 W1a79a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a79a Firmware →

Laserjet Pro Mfp M478 M479 W1a80a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a80a Firmware →

Laserjet Pro Mfp M478 M479 W1a81a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a81a Firmware →

Laserjet Pro Mfp M478 M479 W1a82a Firmware by Hp

View all CVEs affecting Laserjet Pro Mfp M478 M479 W1a82a Firmware →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete printer compromise, lateral movement to internal networks, data exfiltration, or ransomware deployment.

🟠

Likely Case

Printer denial of service, unauthorized access to printed documents, or use as foothold for internal network attacks.

🟢

If Mitigated

Limited to printer functionality disruption if network segmentation and access controls are properly implemented.

🌐 Internet-Facing: HIGH if printers are directly exposed to internet without firewall protection.

🏢 Internal Only: MEDIUM as attackers would need internal network access first.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Buffer overflow exploitation requires crafting malicious font files; no public exploit code known at this time.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware updates specified in HP security bulletin

Vendor Advisory: https://support.hp.com/us-en/document/ish_8651888-8651916-16/hpsbpi03853

Restart Required: Yes

Instructions:

1. Visit HP support site. 2. Enter printer model. 3. Download latest firmware. 4. Upload to printer via web interface or HP tools. 5. Reboot printer.

🔧 Temporary Workarounds

Network segmentation

all

Isolate printers on separate VLAN with restricted access

Disable unnecessary services

all

Turn off unused network services on printers

🧯 If You Can't Patch

• Segment printers on isolated network with strict firewall rules
• Implement network monitoring for suspicious printer traffic

🔍 How to Verify

Check if Vulnerable:

Copy

Check printer firmware version via web interface (Settings > System > Firmware)

Check Version:

Copy

Not applicable - use printer web interface or HP tools

Verify Fix Applied:

Copy

Verify firmware version matches or exceeds patched version from HP advisory

📡 Detection & Monitoring

Log Indicators:

• Unusual font file uploads
• Printer crash/reboot events
• Multiple failed parsing attempts

Network Indicators:

• Unexpected font file transfers to printer IPs
• Malformed font packets

SIEM Query:

Copy

source="printer_logs" AND (event="crash" OR event="reboot") OR dest_ip="printer_subnet" AND protocol="http" AND uri="*.cff"

📊 Metadata

CVE ID: CVE-2023-35177

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: June 30, 2023

Last Updated: November 21, 2024

🔗 References

• https://support.hp.com/us-en/document/ish_8651888-8651916-16/hpsbpi03853 Vendor Advisory
• https://support.hp.com/us-en/document/ish_8651888-8651916-16/hpsbpi03853 Vendor Advisory

📤 Share & Export

Twitter LinkedIn Reddit Copy Link

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-35177, you might also want to check these:

CVE-2022-43604 10.0

CVE-2022-43604 is a critical out-of-bounds write vulnerability in the OpENer EtherNet/IP stack that ...

Same vulnerability type (CWE-787)

CVE-2025-24201 10.0

This critical vulnerability allows malicious web content to break out of the Web Content sandbox via...

Same vulnerability type (CWE-787)

CVE-2020-14871 10.0

This is a critical buffer overflow vulnerability (CWE-787) in Oracle Solaris's Pluggable Authenticat...

Same vulnerability type (CWE-787)