CVE-2013-6427
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11...
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
Exploit likelihood
What each source reports
NVD Score used
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
CVE-2013-6427- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE List No score
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
CVE-2013-6427- Updated
- 2026-11-02
EUVDEUVD-2013-6239 No score
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
EUVD-2013-6239- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8g8-g88f-96q3 No score
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11...
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
GHSA-p8g8-g88f-96q3- Weakness
- CWE-94
- Updated
- 2026-11-02
OSV No score
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
CVE-2013-6427- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6427 No score
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.
- Record
DEBIAN-CVE-2013-6427- Updated
- 2026-11-02
OSVMGASA-2014-0033 No score
Updated hplip package fixes security vulnerabilities
It was discovered that the HPLIP Polkit daemon incorrectly handled temporary files. A local attacker could possibly use this issue to overwrite arbitrary files. (CVE-2013-6402)
It was discovered that HPLIP contained an upgrade tool that would download code in an unsafe fashion. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to execute arbitrary code. (CVE-2013-6427)
Additionnally, this update should fix issues regarding wireless connection to printer hplip after 3.12.9 and prior to version 3.12.11 had issues with setting up wireless connection to printers due to internal code changes which had not been applied consistently.
- Record
MGASA-2014-0033- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10083-1 No score
hplip-3.16.10-1.1 on GA media
These are all security issues fixed in the hplip-3.16.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10083-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
hplipDebian:12 |
before 3.13.11-2 | 3.13.11-2 |
hplipDebian:13 |
before 3.13.11-2 | 3.13.11-2 |
hplipDebian:6.0 From an advisory covering 4 CVEs |
before 3.10.6-2+squeeze2, plus listed versions 3.10.6-23.10.6-2+squeeze1 |
3.10.6-2+squeeze2 |
hplipDebian:7 From an advisory covering 4 CVEs |
before 3.12.6-3.1+deb7u1, plus listed versions 3.12.6-3.1 |
3.12.6-3.1+deb7u1 |
hplipMageia:3 From an advisory covering 2 CVEs |
before 3.12.9-6.3.mga3 | 3.12.9-6.3.mga3 |
hplipopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 3.16.10-1.1 | 3.16.10-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-6427 is a medium vulnerability (CVSS 6.8) in Hp Linux Imaging And Printing Project, published December 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.96%, the 90th percentile. Fixed in hplip 3.13.11-2.
References
ubuntu.com/usn/USN-2085-1
lists.opensuse.org/opensuse-updates/2014-01/msg00087.html
openwall.com/lists/oss-security/2013/12/05/2
debian.org/security/2013/dsa-2829
bugzilla.novell.com/show_bug.cgi?id=853405
nvd.nist.gov/vuln/detail/CVE-2013-6427
Show 14 moreShow less
github.com/advisories/GHSA-p8g8-g88f-96q3
security-tracker.debian.org/tracker/CVE-2013-6427
advisories.mageia.org/MGASA-2014-0033.html
bugs.mageia.org/show_bug.cgi?id=11809
bugs.debian.org/cgi-bin/bugreport.cgi?bug=725876
bugs.launchpad.net/hplip/+bug/1048754
suse.com/security/cve/CVE-2004-0801