CVE-2009-0940

Multiple cross-site request forgery (CSRF) vulnerabilities in the HP Embedded Web Server (EWS) on HP LaserJet Printers, Edgeline Printers, and Digital Senders allow remote attackers to hijack the intranet connectivity of arbitrary users for requests that (1) print documents via unknown vectors, (2) modify the network configuration via a NetIPChange request to hp/device/config_result_YesNo.html/config, or (3) change the password via the Password and ConfirmPassword parameters to hp/device/set_config_password.html/config.

• hp 8100c digital sender • hp 9100c digital sender • hp 9200c digital sender • hp 9250c digital sender • hp color laserjet • hp color laserjet 1500 • hp color laserjet 2500 • hp color laserjet 2500l • hp color laserjet 2500lse • hp color laserjet 2500n • hp color laserjet 2500tn • hp color laserjet 2605dtn • hp color laserjet 4370mfp 20081211 46.211.2 • hp color laserjet 4600 • hp color laserjet 4600dn • hp color laserjet 4600dtn • hp color laserjet 4600hdn • hp color laserjet 4650 • hp color laserjet 4700 • hp color laserjet 4730 mfp • hp color laserjet 5500 • hp color laserjet 5550 • hp color laserjet 8500 • hp color laserjet 8550 • hp color laserjet 9500 • hp color laserjet 9500 mfp • hp color laserjet 9500mfp 20070719 05.011.2 • hp color mfp cm8050 • hp color mfp cm8060 • hp digital senders • hp edgeline printers • hp laserjet 1000 • hp laserjet 1005 • hp laserjet 1010 • hp laserjet 1012 • hp laserjet 1015 • hp laserjet 1018 • hp laserjet 1018s • hp laserjet 1020 • hp laserjet 1020 plus • hp laserjet 1022 • hp laserjet 1022n • hp laserjet 1022nw • hp laserjet 1100 • hp laserjet 1150 • hp laserjet 1160 • hp laserjet 1200 • hp laserjet 1300 • hp laserjet 1320 • hp laserjet 2 • hp laserjet 2000 • hp laserjet 2100 • hp laserjet 2200 • hp laserjet 2200dtn • hp laserjet 2300 • hp laserjet 2300dn • hp laserjet 2400 • hp laserjet 2410 20070410 08.112.3 • hp laserjet 2420 20070410 08.112.3 • hp laserjet 2430 … and 104 more