CyberSecBulletin
CVE-2025-2268NVD status: Analyzed

HP LaserJet MFP M232-M237 Printer Series: Improper Handling of Unexpected Data Type

Published Updated By the CyberSecBulletin desk

CVE-2025-2268 is a high-severity improper handling of unexpected data type vulnerability in HP LaserJet MFP M232-M237 Printer Series from HP, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected HP LaserJet MFP M232-M237 Printer Series versions: See HP Security Bulletin reference for affected versions.. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.46% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update 6gx09a Firmware to 2025-03-24 or a later version.
  2. Update 6gx09e Firmware to 2025-03-24 or a later version.
  3. Update 9yf91e Firmware to 2025-03-24 or a later version.
  4. Read the advisory on support.hp.com for workarounds and exact fixed builds.
  5. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
HPHP LaserJet MFP M232-M237 Printer SeriesSee HP Security Bulletin reference for affected versions.Not stated
HP6gx09a Firmwarebefore 2025-03-242025-03-24
HP6gx09e Firmwarebefore 2025-03-242025-03-24
HP9yf91e Firmwarebefore 2025-03-242025-03-24
HP9yg02e Firmwarebefore 2025-03-242025-03-24
HP9yg05e Firmwarebefore 2025-03-242025-03-24
HP6gw71a Firmwarebefore 2025-03-242025-03-24
HP6gw99a Firmwarebefore 2025-03-242025-03-24
HP6gx00a Firmwarebefore 2025-03-242025-03-24
HP6gx03a Firmwarebefore 2025-03-242025-03-24
HP6gx04a Firmwarebefore 2025-03-242025-03-24
HP6gx05a Firmwarebefore 2025-03-242025-03-24
HP6gx06a Firmwarebefore 2025-03-242025-03-24
HP9yf88a Firmwarebefore 2025-03-242025-03-24
HP9yf89a Firmwarebefore 2025-03-242025-03-24
HP9yf90a Firmwarebefore 2025-03-242025-03-24
HP9yf91a Firmwarebefore 2025-03-242025-03-24
HP9yf92a Firmwarebefore 2025-03-242025-03-24
HP9yf94a Firmwarebefore 2025-03-242025-03-24
HP9yf95a Firmwarebefore 2025-03-242025-03-24
HP9yf96a Firmwarebefore 2025-03-242025-03-24
HP9yf97a Firmwarebefore 2025-03-242025-03-24
HP9yf98a Firmwarebefore 2025-03-242025-03-24
HP9yg02a Firmwarebefore 2025-03-242025-03-24
HP9yg05a Firmwarebefore 2025-03-242025-03-24

Version data comes from the organisation that assigned the CVE; 30 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
NoneNo data is disclosed.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.

Scoring systemScoreSeverityScored by
CVSS 4.06.9MediumCNA (hp.com)
CVSS 3.17.5HighNVD

Official description

The HP LaserJet MFP M232-M237 Printer Series may be vulnerable to a denial of service attack when a specially crafted request message is sent via Internet Printing Protocol (IPP).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Handling of Unexpected Data Type

The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).

How developers prevent this class of flaw

  • Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

More Improper Handling of Unexpected Data Type vulnerabilities (CWE-241)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Improper Handling of Unexpected Data Type vulnerabilities

Spotted an error? Tell us.