hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute…

Published 19 y ago 2007-10-13 · modified 4 mo ago 2026-06-16 · JSON

CVSS

7.6

v2.0 · NVD

CISA KEV

not known exploited

EPSS

67.3%

percentile 99%

Public exploits

Metasploit · Exploit-DB

hpssd in Hewlett-Packard Linux Imaging and Printing Project (hplip) 1.x and 2.x before 2.7.10 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a from address, which is not properly handled when invoking sendmail.

Exploit prediction (EPSS)

67.26% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

Exploits and detections

Metasploit exploit/linux/misc/hplip_hpssd_exec HPLIP hpssd.py From Address Arbitrary Command Execution · metasploit exploit, excellent rank · 2007-10-04
EDB-16837 hplip - 'hpssd.py' From Address Arbitrary Command Execution (Metasploit) · remote · 2010-10-09

CVSS scores

Assigned by	Version	Score	Vector
NVD	2.0	7.6	`AV:N/AC:H/Au:N/C:C/I:C/A:C`

Classification

Weakness

CWE-20 Improper Input Validation

References

redhat.com /archives/fedora-package-announce/2007-October/msg00200.html · vendor-advisory, x_refsource_FEDORA, x_transferred
vupen.com /english/advisories/2007/3479 · vdb-entry, x_refsource_VUPEN, x_transferred
secunia.com /advisories/27271 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/27202 · third-party-advisory, x_refsource_SECUNIA, x_transferred
bugs.gentoo.org /show_bug.cgi?id=195565 · x_refsource_CONFIRM, x_transferred
launchpad.net /bugs/149121 · x_refsource_MISC, x_transferred
secunia.com /advisories/27224 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/27221 · third-party-advisory, x_refsource_SECUNIA, x_transferred
security.gentoo.org /glsa/glsa-200710-26.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
usn.ubuntu.com /530-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
debian.org /security/2008/dsa-1462 · vendor-advisory, x_refsource_DEBIAN, x_transferred
secunia.com /advisories/28453 · third-party-advisory, x_refsource_SECUNIA, x_transferred
secunia.com /advisories/27397 · third-party-advisory, x_refsource_SECUNIA, x_transferred
securitytracker.com /id?1018806 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/26054 · vdb-entry, x_refsource_BID, x_transferred
mandriva.com /en/security/advisories?name=MDKSA-2007:201 · vendor-advisory, x_refsource_MANDRIVA, x_transferred
secunia.com /advisories/27332 · third-party-advisory, x_refsource_SECUNIA, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=319921 · x_refsource_CONFIRM, x_transferred
lists.opensuse.org /opensuse-security-announce/2007-10/msg00006.html · vendor-advisory, x_refsource_SUSE, x_transferred
secunia.com /advisories/27232 · third-party-advisory, x_refsource_SECUNIA, x_transferred
redhat.com /support/errata/RHSA-2007-0960.html · vendor-advisory, x_refsource_REDHAT, x_transferred
oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10692 · vdb-entry, signature, x_refsource_OVAL, x_transferred
qa.mandriva.com /show_bug.cgi?id=30719 · x_refsource_CONFIRM, x_transferred
exchange.xforce.ibmcloud.com /vulnerabilities/37183 · vdb-entry, x_refsource_XF, x_transferred

Sources

CVE List: CVE-2007-5208
NVD: CVE-2007-5208

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.