CVE-2022-24293

Deeper analysis

Certain HP Print devices are affected by CVE-2022-24293, a remotely exploitable flaw that can result in information disclosure, denial of service, or remote code execution. The vulnerability carries a CVSS 3.1 base score of 9.8, reflecting network attack vector, low attack complexity, and no required authentication or user interaction, with high impact across confidentiality, integrity, and availability.

An unauthenticated attacker with network access can leverage the issue to read sensitive data, disrupt device operation, or execute arbitrary code on the affected printers. The absence of a specific CWE classification leaves the precise root cause unspecified in public records.

HP has published mitigation guidance in support documents available at https://support.hp.com/us-en/document/ish_5950417-5950443-16, which practitioners should consult for firmware updates or configuration changes applicable to the impacted models.

EPSS for the CVE rose from a low baseline to a peak of 0.1133 on 2025-12-11 before receding to the current value of 0.0204, indicating a period of increased exploitation interest well after the 2022 disclosure.