CVE-2024-5143
Medium
Description
A user with device administrative privileges can change existing SMTP server settings on the device, without having to re-enter SMTP server credentials. By redirecting send-to-email traffic to the new server, the original SMTP server credentials may potentially be exposed.
SeverityMedium
CVSS6.8
Exploit probability—
ProductHp W1a78a Firmware
PublishedMay 23, 2024
First seenMay 23, 2024
Weakness typeCWE-306Missing authentication for critical function
How to fix
Update
- hp w1a78a_firmware002_2413A or later
- hp w1a80a_firmware002_2413A or later
- hp w1a79a_firmware002_2413A or later
- hp w1a82a_firmware002_2413A or later
- hp w1a81a_firmware002_2413A or later
- hp w1a77a_firmware002_2413A or later
- hp w1a76a_firmware002_2413A or later
- hp w1a75a_firmware002_2413A or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hp w1a78a_firmware | v < 002_2413A | 002_2413A |
| hp w1a80a_firmware | v < 002_2413A | 002_2413A |
| hp w1a79a_firmware | v < 002_2413A | 002_2413A |
| hp w1a82a_firmware | v < 002_2413A | 002_2413A |
| hp w1a81a_firmware | v < 002_2413A | 002_2413A |
| hp w1a77a_firmware | v < 002_2413A | 002_2413A |
| hp w1a76a_firmware | v < 002_2413A | 002_2413A |
| hp w1a75a_firmware | v < 002_2413A | 002_2413A |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.