CVE-2009-2684
Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.
Key facts
- CVSS score
- 4.3 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N- Weakness (CWE)
- CWE-79
- EPSS score
- 2.2% (82th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2009-2677)
- Published
- October 13, 2009
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2009-2677 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- hp / cm8050 mfp
- hp / cm8060 mfp
- hp / color laserjet 3000n
- hp / color laserjet 3600n
- hp / color laserjet 3800n
- hp / color laserjet 4700n
- hp / color laserjet 4730 mfp
- hp / color laserjet 6040 mfp
- hp / color laserjet cm4730 mfp
- hp / color laserjet cp3505
- hp / color laserjet cp4005n
- hp / color laserjet cp6015
- hp / ds 9200c
- hp / ds 9250c
- hp / laserjet 2410
- hp / laserjet 2420
- hp / laserjet 2430n
- hp / laserjet 4240
- hp / laserjet 4250n
- hp / laserjet 4345 mfp
- hp / laserjet 4350n
- hp / laserjet 5200n
- hp / laserjet 9040 mfp
- hp / laserjet 9040n
- hp / laserjet 9050 mfp
- hp / laserjet 9050n
- hp / laserjet m3027 mfp
- hp / laserjet m3035 mfp
- hp / laserjet m4345x mfp
- hp / laserjet m5025 mfp
- hp / laserjet m9040 mpf
- hp / laserjet m9050 mpf
- hp / laserjet p3005n
- hp / laserjet p4014
- hp / laserjet p4515
Certified products that may be affected
2 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.
- HP Laser Jet M4345 MFP System Firmware Version 48.021.7, HP LaserJet M3027 MFP System Firmware Version 48.021.7A, HP LaserJet M3035 MFP system Firmware Version 48.021.7A, HP LaserJet M5025 MFP System Firmware Version 48.021.7A, HP LaserJet M5035 MFP System Firmware Version 48.021.7A, HP Color LaserJet 4730 MFP System Firmware 46.151.8 - Hewlett-Packard Company - Common Criteria CCEVS-VR-0048-2007 - archived
- Hewlett Packard HP LaserJet 9040 MFP System Firmware Version 08.091.3, HP LaserJet 9050 MFP System Firmware Version 08.091.3, HP LaserJet 4345 MFP System Firmware Version 09.091.4, HP Color LaserJet CM4730 MFP System Firmware Version 50.021.4 - Hewlett-Packard Company - Common Criteria CCEVS-VR-VID-10297-2008 - archived
References
- http://dsecrg.com/pages/vul/show.php?id=148(Exploit)
- http://marc.info/?l=bugtraq&m=125493484205823&w=2
- http://secunia.com/advisories/36969(Vendor Advisory)
- http://www.securityfocus.com/archive/1/507038/100/0/threaded
- http://www.securityfocus.com/bid/36613
- http://www.vupen.com/english/advisories/2009/2850(Vendor Advisory)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53677
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain