CVE-2009-2684: HP CM8050 Mfp

Medium severity, CVSS 4.3. EPSS: 2.2% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in Jetdirect and the Embedded Web Server (EWS) on certain HP LaserJet and Color LaserJet printers, and HP Digital Senders, allow remote attackers to inject arbitrary web script or HTML via the (1) Product_URL or (2) Tech_URL parameter in an Apply action to the support_param.html/config script.

Affected products

• HP CM8050 Mfp: any version
• HP CM8060 Mfp: any version
• HP Color Laserjet 3000n: any version
• HP Color Laserjet 3600n: any version
• HP Color Laserjet 3800n: any version
• HP Color Laserjet 4700n: any version
• HP Color Laserjet 4730 Mfp: any version
• HP Color Laserjet 6040 Mfp: any version
• HP Color Laserjet CM4730 Mfp: any version
• HP Color Laserjet CP3505: any version
• HP Color Laserjet CP4005N: any version
• HP Color Laserjet CP6015: any version
• HP Ds 9200c: any version
• HP Ds 9250c: any version
• HP Laserjet 2410: any version
• HP Laserjet 2420: any version
• HP Laserjet 2430n: any version
• HP Laserjet 4240: any version
• HP Laserjet 4250n: any version
• HP Laserjet 4345 Mfp: any version
• HP Laserjet 4350n: any version
• HP Laserjet 5200n: any version
• HP Laserjet 9040 Mfp: any version
• HP Laserjet 9040n: any version
• HP Laserjet 9050 Mfp: any version
• and 10 more

Published 2009-10-13. Last modified 2026-06-16.