7.8high
CVE-2002-1796
ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services,…
Published 23 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 35%
Public exploits
0
none known
Summary
ChaiVM EZloader for HP color LaserJet 4500 and 4550 and HP LaserJet 4100 and 8150 does not properly verify JAR signatures for new services, which allows local users to load unauthorized Chai services.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction (EPSS)
0.41% probability of exploitation in the next 30 days, higher than 35% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-347 Improper Verification of Cryptographic Signature
References
- phenoelit.de /stuff/HP_Chai.txt · x_refsource_MISC, x_transferred
- securityfocus.com /bid/5334 · vdb-entry, x_refsource_BID, x_transferred
- online.securityfocus.com /advisories/4317 · vendor-advisory, x_refsource_HP, x_transferred
- iss.net /security_center/static/9695.php · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /archive/1/284648 · mailing-list, x_refsource_BUGTRAQ, x_transferred
Sources
- CVE List: CVE-2002-1796
- NVD: CVE-2002-1796
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.