5.0
MEDIUM
CVE-2012-5221
HP Printers Directory Traversal Vulnerability
Description

Directory traversal vulnerability in the PostScript Interpreter, as used on the HP LaserJet 4xxx, 5200, 90xx, M30xx, M4345, M50xx, M90xx, P3005, and P4xxx; LaserJet Enterprise P3015; Color LaserJet 3xxx, 47xx, 5550, 9500, CM60xx, CP35xx, CP4005, and CP6015; Color LaserJet Enterprise CP4xxx; and 9250c Digital Sender with model-dependent firmware through 52.x allows remote attackers to read arbitrary files via unknown vectors.

INFO

Published Date :

April 29, 2013, 9:55 p.m.

Last Modified :

Nov. 21, 2024, 1:44 a.m.

Remotely Exploitable :

Yes !

Impact Score :

2.9

Exploitability Score :

10.0
Public PoC/Exploit Available at Github

CVE-2012-5221 has a 1 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2012-5221 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Hp laserjet_4250
2 Hp laserjet_4350
3 Hp laserjet_9040
4 Hp laserjet_9050
5 Hp color_laserjet_4700
6 Hp color_laserjet_4730_mfp
7 Hp color_laserjet_5550
8 Hp color_laserjet_9500_mfp
9 Hp laserjet_4240
10 Hp laserjet_4345_mfp
11 Hp laserjet_9050_mfp
12 Hp laserjet_m3027_mfp
13 Hp laserjet_m3035_mfp
14 Hp laserjet_m4345_mfp
15 Hp laserjet_m5025_mfp
16 Hp laserjet_m5035_mfp
17 Hp laserjet_p3005
18 Hp laserjet_p4014
19 Hp laserjet_p4015
20 Hp color_laserjet_cp3525
21 Hp color_laserjet_cp6015
22 Hp color_laserjet_3000
23 Hp color_laserjet_3800
24 Hp color_laserjet_cm6030_mfp
25 Hp color_laserjet_cm6040_mfp
26 Hp color_laserjet_cp3505
27 Hp color_laserjet_cp4005
28 Hp color_laserjet_enterprise_cp4025
29 Hp color_laserjet_enterprise_cp4525
30 Hp digital_sender_9250c
31 Hp laserjet_5200l
32 Hp laserjet_5200n
33 Hp laserjet_9040_mfp
34 Hp laserjet_enterprise_p3015
35 Hp laserjet_m9040_mpf
36 Hp laserjet_m9050_mpf
37 Hp laserjet_p4515

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Simple metasploit module that attempts to dump HP printer web admin credentials

hp metasploit printers cve-2012-5221

Python

Updated: 1 year, 3 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 20, 2022, 6:50 p.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2012-5221 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2012-5221 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=1023
    Added Reference https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03744742
    Added Reference https://h20566.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03744742
  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • Initial Analysis by [email protected]

    Apr. 30, 2013

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2012-5221 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2012-5221 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.23 }} 0.00%

score

0.59354

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability