CVE-2025-2268
Hp 6Gx09A Firmware ≤ 2025-03-24
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2025-2268 is a medium-severity Improper Handling of Unexpected Data Type (CWE-241) vulnerability in Hp 6Gx09A Firmware. Its CVSS base score is 6.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-2268 is a denial-of-service vulnerability affecting the HP LaserJet MFP M232-M237 Printer Series. The issue arises when a specially crafted request message is sent via the Internet Printing Protocol (IPP), potentially disrupting printer functionality. Published on 2025-03-14, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is linked to CWE-241.
Remote attackers can exploit this vulnerability over the network with low complexity, requiring no privileges, authentication, or user interaction. By transmitting a malicious IPP request to an affected printer, an attacker can cause a denial of service, severely impacting availability while leaving confidentiality and integrity unaffected.
HP has issued a security bulletin detailing the vulnerability at https://support.hp.com/us-en/document/ish_12114154-12114176-16/hpsbpi04013, which security practitioners should consult for patch availability and mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6444
Vulnerability Data
The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation explicitly checks that supplied data matches expected types and rejects mismatches before they reach processing logic.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper input validation and type checking to prevent this weakness.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type-handling flaws but does not itself implement the preventive control.
Secure development lifecycle includes input validation and type checking that directly mitigates improper handling of unexpected data types.
Application security requirements typically mandate strong input validation and type enforcement to prevent malformed data processing.
Secure system architecture principles encourage robust input handling but do not specifically address data-type validation.
Secure coding standards explicitly require type checking and input sanitization, directly addressing improper handling of unexpected data types.