LiveActive security incident?Get immediate response
CVE Record

CVE-2022-28721: Certain HP Print Products are potentially vulnerable to Remote Code Execution.

Certain HP Print Products are potentially vulnerable to Remote Code Execution.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

This CVE is a critical remote code execution issue in certain HP inkjet, LaserJet Pro, and PageWide Pro printers. Its CVSS vector indicates network reachability with no authentication or user interaction. Vulnerable printers could become a foothold for disruption, data exposure, or lateral movement. The bundle does not identify specific models or firmware versions.

Executive priority

Prioritize identification and remediation of affected HP printers, especially those on flat networks or reachable from untrusted segments. The business concern is not just print disruption; compromised printers can support broader network intrusion. Urgency is critical, but confirmed exploitation is not evidenced in the provided sources.

Technical view

CVE-2022-28721 is described as remote code execution affecting multiple HP print product lines. CVSS 3.1 is 9.8 with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. No CWE or technical root cause is provided in the bundle. Model-specific exposure must be confirmed against HP advisory HPSBPI03810.

Likely exposure

Organizations using HP inkjet printers, HP LaserJet Pro printers, or HP PageWide Pro printers may be exposed. Internet-facing or broadly reachable printer management networks increase business risk. The source bundle does not provide a complete affected-model list.

Exploitation context

The CVE is not listed as CISA KEV in the provided bundle, and no cited source states active exploitation. Treat the issue as high priority because the CVSS vector indicates unauthenticated network attack potential, not because exploitation is confirmed here.

Researcher notes

Public evidence in the bundle is sparse. It confirms RCE classification, critical CVSS scoring, affected HP product families, and the HP advisory reference. It does not include root cause, vulnerable protocol, exploit prerequisites beyond CVSS, affected CPEs, or fixed firmware levels.

Mitigation direction

  • Review HP advisory HPSBPI03810 for affected models and vendor guidance.
  • Apply only HP-published firmware or security updates for confirmed affected devices.
  • Restrict printer access to trusted networks and management hosts.
  • Remove any unnecessary internet exposure for printer services.
  • Prioritize shared office, production, and externally reachable printers.

Validation and detection

  • Inventory HP inkjet, LaserJet Pro, and PageWide Pro printers.
  • Compare model and firmware details against HP advisory HPSBPI03810.
  • Check whether printer services are reachable from untrusted networks.
  • Verify firmware update status after remediation.
  • Document exceptions where vendor guidance is unavailable or pending.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-28721 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
2Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2022-28721Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aCertain HP inkjet printers, HP LaserJet Pro printers, HP PageWide Pro printers.MultipleListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.