Security readout for executives and security teams
Plain-English summary
CVE-2020-28419 affects certain HP printer driver software or application installation packages. The public description says arbitrary code execution could occur during installation. HP lists affected LaserJet, LaserJet Pro, PageWide, PageWide Pro, inkjet, and OfficeJet package versions, but the source bundle does not provide CVSS, exploit details, or impact depth.
Executive priority
Prioritize as an endpoint hygiene and software deployment control issue. The business urgency depends on how widely HP printer packages are installed or staged, but incomplete public severity data prevents a defensible criticality rating.
Technical view
The issue is tied to installation of specific HP printer software packages below HP-listed version thresholds. The execution context, trigger conditions, CWE, and exact vulnerable component are not stated in the supplied sources. Treat this as endpoint software supply and deployment exposure rather than printer firmware compromise unless HP guidance says otherwise.
Likely exposure
Exposure is most likely on endpoints or deployment systems using older HP printer driver or application packages for the listed printer families. Risk may persist where old installers remain in software shares, endpoint management tools, or imaging workflows.
Exploitation context
The source bundle does not cite active exploitation, and KEV status is false. Public details are sparse: only arbitrary code execution during installation is described, without exploit prerequisites, attacker position, or proof-of-concept status.
Researcher notes
Key unknowns are execution context, exact vulnerable installer behavior, required local interaction, and whether exploitation needs prior filesystem control. The HP advisory is the primary remediation source; avoid assuming affected models, CVSS severity, or exploitability beyond the supplied description.
Mitigation direction
- Review HP advisory C07058567 for affected package versions and fixed releases.
- Update affected HP driver or application packages to HP-supported corrected versions.
- Remove outdated HP printer installers from deployment shares and endpoint management catalogs.
- Limit who can install printer software on managed endpoints.
- Use only trusted HP distribution sources for replacement packages.
Validation and detection
- Inventory HP printer driver and application package versions across endpoints.
- Compare discovered versions with HP advisory C07058567 affected thresholds.
- Check software deployment tools for retained vulnerable HP installer packages.
- Confirm updated packages are used in imaging and printer onboarding workflows.
- Document systems where version evidence is missing or unverifiable.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-28419 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://support.hp.com/us-en/document/c07058567CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.