Original URL: https://www.theregister.com/2013/08/08/hp_plug_password_leaking_printer_vuln/

HP plugs password-leaking printer flaw

Bad news: Most office bods won't patch it. Good news: Most office bods won't find password

By John Leyden

Posted in Security, 8th August 2013 10:03 GMT

Security flaws in a range of HP printers create a way for hackers to lift administrator's passwords and other potentially sensitive information from vulnerable devices, infosec experts have warned.

HP has released patches for the affected LaserJet Pro printers to defend against the vulnerability (CVE-2013-4807), which was discovered by Michał Sajdak of Securitum.pl. Sajdak discovered it was possible to extract plaintext versions of users' passwords via hidden URLs hardcoded into the printers’ firmware. A hex representation of the admin password is stored in a plaintext URL, though it looks encrypted to a casual observer.

Sajdak also discovered Wi-Fi-enabled printers leaked Wi-Fi settings and Wi-Fi Protected Setup PIN codes, as an advisory from the Polish security researcher explains.

HP has released firmware updates for the following affected printers:

HP's advisory is here.

Consumers aren't very good at patching their computers, much less their printers, which rarely need security updates.

"The bad news is that many printer owners probably aren’t aware that the security issue exists, or simply won’t bother to apply the firmware update," security watcher Graham Cluley notes. ®