CVE-2009-0940
Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.
Key facts
- CVSS score
- 5.1 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:H/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-352
- EPSS score
- 1.1% (64th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-0937)
- Published
- March 18, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-0937 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- hp / 8100c digital sender
- hp / 9100c digital sender
- hp / 9200c digital sender
- hp / 9250c digital sender
- hp / color laserjet
- hp / color laserjet 1500
- hp / color laserjet 2500
- hp / color laserjet 2500l
- hp / color laserjet 2500lse
- hp / color laserjet 2500n
- hp / color laserjet 2500tn
- hp / color laserjet 2605dtn
- hp / color laserjet 4370mfp
- hp / color laserjet 4600
- hp / color laserjet 4600dn
- hp / color laserjet 4600dtn
- hp / color laserjet 4600hdn
- hp / color laserjet 4650
- hp / color laserjet 4700
- hp / color laserjet 4730 mfp
- hp / color laserjet 5500
- hp / color laserjet 5550
- hp / color laserjet 8500
- hp / color laserjet 8550
- hp / color laserjet 9500
- hp / color laserjet 9500 mfp
- hp / color laserjet 9500mfp
- hp / color mfp cm8050
- hp / color mfp cm8060
- hp / digital senders
- hp / edgeline printers
- hp / laserjet 1000
- hp / laserjet 1005
- hp / laserjet 1010
- hp / laserjet 1012
- hp / laserjet 1015
- hp / laserjet 1018
- hp / laserjet 1018s
- hp / laserjet 1020
- hp / laserjet 1020 plus
- hp / laserjet 1022
- hp / laserjet 1022n
- hp / laserjet 1022nw
- hp / laserjet 1100
- hp / laserjet 1150
- hp / laserjet 1160
- hp / laserjet 1200
- hp / laserjet 1300
- hp / laserjet 1320
- hp / laserjet 2
and 114 more…
Certified products that may be affected
3 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- HP Color LaserJet Enterprise M553 Printer Series, HP Laserjet Enterprise M506, M604, M605 and M606 Printer series - HP Inc. - Common Criteria CSEC2015002 - archived
- HP Laser Jet M4345 MFP System Firmware Version 48.021.7, HP LaserJet M3027 MFP System Firmware Version 48.021.7A, HP LaserJet M3035 MFP system Firmware Version 48.021.7A, HP LaserJet M5025 MFP System Firmware Version 48.021.7A, HP LaserJet M5035 MFP System Firmware Version 48.021.7A, HP Color LaserJet 4730 MFP System Firmware 46.151.8 - Hewlett-Packard Company - Common Criteria CCEVS-VR-0048-2007 - archived
- Hewlett Packard HP LaserJet 9040 MFP System Firmware Version 08.091.3, HP LaserJet 9050 MFP System Firmware Version 08.091.3, HP LaserJet 4345 MFP System Firmware Version 09.091.4, HP Color LaserJet CM4730 MFP System Firmware Version 50.021.4 - Hewlett-Packard Company - Common Criteria CCEVS-VR-VID-10297-2008 - archived
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01684566(Vendor Advisory)
- http://osvdb.org/52847
- http://osvdb.org/52848
- http://osvdb.org/52849
- http://www.louhinetworks.fi/advisory/HP_20090317.txt(Exploit)
- http://www.securityfocus.com/archive/1/501884/100/0/threaded
- http://www.securityfocus.com/bid/34143
- http://www.vupen.com/english/advisories/2009/0754
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain