CVE-2023-4063
📋 TL;DR
HP OfficeJet Pro printers are vulnerable to a Denial of Service attack when receiving a specially crafted eSCL URL GET request. This vulnerability allows attackers to crash the printer's web service, making it temporarily unavailable for printing or management. Only specific HP OfficeJet Pro models with vulnerable firmware are affected.
💻 Affected Systems
- HP OfficeJet Pro printers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Printer becomes completely unresponsive, requiring physical power cycle to restore functionality, disrupting printing operations for extended periods.
Likely Case
Temporary service interruption where printer web interface becomes unavailable but printing may continue via other protocols, requiring reboot to restore full functionality.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting who can send requests to printer management interfaces.
🎯 Exploit Status
Exploitation requires network access to printer's web interface and knowledge of vulnerable eSCL endpoint URLs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 2023.10.17 or later
Vendor Advisory: https://support.hp.com/us-en/document/ish_10321463-10321488-16/hpsbpi03927
Restart Required: Yes
Instructions:
1. Access printer web interface. 2. Navigate to Settings > Updates. 3. Check for firmware updates. 4. Apply firmware version 2023.10.17 or later. 5. Printer will automatically restart after update.
🔧 Temporary Workarounds
Disable eSCL Protocol
allTemporarily disable the eSCL scanning protocol to prevent exploitation while awaiting patch
Access printer web interface > Settings > Network > eSCL > Disable
Network Segmentation
allRestrict network access to printer management interfaces
Configure firewall rules to limit access to printer IP on ports 80/443 to authorized users only
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach printer management interfaces
- Monitor printer logs for unusual eSCL URL requests and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check printer firmware version via web interface: Settings > About > Firmware Version. If version is earlier than 2023.10.17, printer is vulnerable.Check Version:
curl -s http://printer-ip/hp/device/info_configuration.html | grep -i firmwareVerify Fix Applied:
Confirm firmware version is 2023.10.17 or later in printer web interface Settings > About section.📡 Detection & Monitoring
Log Indicators:
- Multiple failed eSCL URL requests
- Printer web service restart events
- Unusual GET requests to eSCL endpoints
Network Indicators:
- Unusual traffic patterns to printer port 80/443 with eSCL URLs
- Multiple rapid GET requests to printer
SIEM Query:
source="printer_logs" AND (url="*eSCL*" OR event="service_restart")