Ofufuza achitetezo ochokera ku F-Secure apeza chiwopsezo chachikulu (CVE-2021-39238) chomwe chikukhudza oposa 150 HP LaserJet, LaserJet Managed, PageWide ndi PageWide Managed osindikiza ndi MFPs. Chiwopsezocho chimakulolani kuti mupangitse kusefukira kwa buffer mu purosesa yamafonti potumiza chikalata chopangidwa mwapadera cha PDF kuti chisindikizidwe ndikukwaniritsa ma code anu pamlingo wa firmware. Vutoli lakhalapo kuyambira 2013 ndipo lidakhazikitsidwa muzosintha za firmware zomwe zidasindikizidwa pa Novembara 1 (wopanga adadziwitsidwa za vutoli mu Epulo).
Kuwukiraku kutha kuchitidwa pa osindikiza olumikizidwa kwanuko komanso pamakina osindikizira a netiweki. Mwachitsanzo, wowukira atha kugwiritsa ntchito njira zama social engineering kukakamiza wogwiritsa ntchito kusindikiza fayilo yoyipa, kuwukira makina osindikizira pogwiritsa ntchito makina omwe asokonezedwa kale, kapena kugwiritsa ntchito njira yofanana ndi "DNS rebinding," yomwe imalola, wogwiritsa ntchito akatsegula china chake. patsamba la msakatuli, kutumiza pempho la HTTP ku doko la netiweki la chosindikizira (9100/ TCP, JetDirect), silikupezeka kuti lipezeke mwachindunji kudzera pa intaneti.
Pambuyo pakugwiritsa ntchito bwino pachiwopsezocho, chosindikizira chosokoneza chingagwiritsidwe ntchito ngati njira yoyambira kuwukira pa netiweki yakomweko, kununkhiza kuchuluka kwa magalimoto, kapena kusiya malo obisika kwa omwe akuukira pa netiweki yakomweko. Chiwopsezocho ndichoyeneranso kupanga ma botnets kapena kupanga nyongolotsi zapaintaneti zomwe zimasanthula machitidwe ena osatetezeka ndikuyesa kuwapatsira. Kuchepetsa kuwonongeka kwa chosindikizira kunyengerera, tikulimbikitsidwa kuyika osindikiza pamaneti mu VLAN yosiyana, kuletsa chowotcha moto kuti zisakhazikitse maulumikizidwe otuluka kuchokera kwa osindikiza, ndikugwiritsa ntchito seva yosindikiza yapakatikati m'malo mofikira chosindikizira kuchokera kumalo ogwirira ntchito.
Ofufuza apezanso chiwopsezo china (CVE-2021-39237) mu osindikiza a HP, zomwe zimapangitsa kuti athe kupeza mwayi wokwanira ku chipangizocho. Mosiyana ndi chiwopsezo choyamba, vutoli limaperekedwa pachiwopsezo chochepa, popeza kuukira kumafuna mwayi wofikira wosindikiza (muyenera kulumikizana ndi doko la UART pafupifupi mphindi 5).
Source: opennet.ru