HP Color LaserJet MFP M283fdw

[RichardHawkins]

We have a client with a HP Color LaserJet MFP M283fdw.

We have updated the printer to firmware version 20250219 and then rescanned with our Vulnerability Management Agent

On rescan the printer shows these vulnerabilities:

["CVE-2017-9765"]	Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.
["CVE-2019-7659"]	Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a server application is built with the -DWITH_COOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ libraries, as these are built with that flag.
["CVE-2020-13574"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13575"]	A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13576"]	A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13577"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13578"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2021-21783"]	A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
["gSOAP","Virata-EmWeb"]

I checked HP Security Bulletin Archive | HP® Support AND HP Security Bulletins | HP® Support but only found CVE-2017-9765 in the archives.

Can you confirm if  firmware version 20250219 mitigated the CVE from 2019, 2020 and 2021.

[Kuroi_Kenshi · Accepted solution]

Hi @RichardHawkins,

Welcome to the HP Support Community!

Thanks for reaching out!

We're thrilled to have the opportunity to assist you and provide a solution.

I understand your client’s HP Color LaserJet MFP M283fdw is showing multiple gSOAP-related vulnerabilities even after updating to firmware version 20250219. Let’s go through a few points to clarify the status and mitigation options.

    a. Check HP Security Bulletins
      • HP officially publishes resolved vulnerabilities in HP Security Bulletin Archive and the current HP Security Bulletins page.
      • As you noted, CVE-2017-9765 is listed, but the other CVEs from 2019–2021 are not referenced for this firmware.

    b. Understand gSOAP Vulnerabilities
      • These CVEs relate to SOAP parsing and WS- plugin functionality* in the embedded gSOAP library.
      • HP firmware updates typically include mitigations for critical vulnerabilities, but not all gSOAP CVEs are addressed in every firmware version.
      • If the CVE is not listed in HP’s Security Bulletin for that firmware, HP has not officially confirmed mitigation for that vulnerability in this version.

    c. Recommended Actions
      • Isolate the printer from untrusted networks where possible until HP confirms mitigation.
      • Enable firewall and network filtering to block unsolicited SOAP requests (port 80/443 or HTTP services used by the printer).
      • Monitor HP security updates for the M283fdw for any future firmware releases that address these CVEs.
      • Continue using HP Security Bulletin page for official confirmation rather than relying solely on vulnerability scans.

    d. Confirming Mitigation Status
      • Currently, only CVE-2017-9765 is confirmed mitigated in firmware 20250219.
      • CVE-2019-7659, CVE-2020-13574–13578, and CVE-2021-21783 are not listed in HP’s bulletins for this firmware; mitigation has not been officially confirmed.

I hope this helps.

I'm glad I could help! 😊 If this resolved your issue, please mark it as "Accepted Solution" and click "Yes" on "Was this reply helpful?" Your feedback not only keeps us going but also helps others find the solution faster! 👍✨

Take care and have an amazing day ahead! 🚀

Best regards,

[RichardHawkins]

I accepted the solution but would like to know how these CVEs affecting my client's printers is going to be addressed: 

["CVE-2017-9765"]	Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.
["CVE-2019-7659"]	Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a server application is built with the -DWITH_COOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ libraries, as these are built with that flag.
["CVE-2020-13574"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13575"]	A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13576"]	A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13577"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2020-13578"]	A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
["CVE-2021-21783"]	A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
["gSOAP","Virata-EmWeb"]