CVE-2024-2209
HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
- Record
CVE-2024-2209- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-27168
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
- Record
EUVD-2024-27168- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4qvc-25ff-jcmq
A user with administrative privileges can create a compromised dll file of the same name as the...
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
- Record
GHSA-4qvc-25ff-jcmq- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
A user with administrative privileges can create a compromised dll file of the same name as the original dll within the HP printer’s Firmware Update Utility (FUU) bundle and place it in the Microsoft Windows default downloads directory which can lead to potential arbitrary code execution.
- Record
CVE-2024-2209- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L - Weakness
- CWE-94
- Updated
- 2026-11-02
Affected products
- hp, inc. hp printer firmware update utility
- hp inc printer firmware update utility
- hp 26k67a firmware
- hp 26k67b firmware
- hp 26k68a firmware
- hp 26k68b firmware
- hp 26k69a firmware
- hp 26k70a firmware
- hp 26k70b firmware
- hp 26k71a firmware
- hp 26k72a firmware
- hp 26k72b firmware
Show 18 moreShow less
- hp 297w8a firmware
- hp 297x0a firmware
- hp 297x1a firmware
- hp 2a9q5a firmware
- hp 3xv17a firmware
- hp 3xv19a firmware
- hp 4ws04a firmware
- hp 5ar83a firmware
- hp 5ar84a firmware
- hp 5ar85a firmware
- hp 7fr20a firmware
- hp 7fr21a firmware
- hp 7fr52a firmware
- hp 7fr53a firmware
- hp 7fr57a firmware
- hp 7fr58a firmware
- hp 7fr61a firmware
- hp 8rk11a firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-2209 is a medium vulnerability (CVSS 6.3) in Hp, Inc. Hp Printer Firmware Update Utility, published March 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. No source names a fixed version.