HP Inc HP AC Print & Scan and HP Output Central Path Traversal May Enable Arbitrary File Write

HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software.

• HP AC Print & Scan: The normalized record marks versions matching <V1R4.0.027 as affected. HP's bulletin lists V1R4.0.027 or later as the software update for this product.
• HP Output Central: The normalized record marks versions matching <V1R4.0.029 as affected. HP's bulletin lists V1R4.0.029 as the updated version.

No additional products or release branches are established by the supplied evidence. The normalized record sets the default status to unaffected for versions that do not match the stated conditions.

HP maps the issue to CWE-22, path traversal. The affected component is the HP Advance server hosting the software; the record indicates that network-delivered input may reach vulnerable path handling, but it does not identify the endpoint, parameter, file path, or exact validation failure. The structured assessment describes network reachability, low attack complexity, no required prior privileges, and no user interaction. Under certain conditions, successful exploitation may permit arbitrary file writing and may lead to privilege escalation or remote code execution, but the exact exploitation chain is not disclosed. The record does not establish which deployment configurations beyond the listed products are exploitable or whether every HP Advance server is exposed.

The structured assessment describes network-based exploitation without authentication or prior privileges, without user interaction, and with low complexity. This makes network-reachable HP Advance servers a priority for review, but it does not by itself prove that every deployment is exploitable. HP identifies Joseph Chiarchiaro, an independent security researcher, as the reporter. The supplied record does not establish observed exploitation, a specific campaign, or a public exploit.

The vulnerability can affect the integrity of the HP Advance server through arbitrary file write. Under certain conditions, that result may lead to remote code execution or privilege escalation, but the actual privileges obtained and scope of control are not established. The supplied assessment indicates that the primary effects concern integrity and availability; it does not assign a confidentiality impact. Organisational consequences may include software or configuration changes, service interruption, and recovery effort, depending on which files are affected and how the server is configured. No specific incident or breach is established by the evidence.

Successful exploitation could allow an attacker to modify or create files on the HP Advance server, undermining the integrity of software or data managed by that server. The potential impact also includes service disruption if written files damage components required for server operation. HP's description includes possible privilege escalation or remote code execution under certain conditions, which could expand the attacker's control of the server. The record does not confirm a specific breach and does not describe a confidentiality impact.

1. Update HP AC Print & Scan to V1R4.0.027 or later and update HP Output Central to V1R4.0.029, using the applicable product branch.
2. HP instructs customers to obtain the software update by contacting E-SW Ops Support at e-sw-ops-support@hp.com.
3. Prioritize HP Advance servers that are network-reachable, especially servers providing services without authentication. Reducing unnecessary network exposure while waiting for an update is general defensive guidance, not an HP-confirmed workaround.
4. After updating, verify the installed version on every server and record the systems that were remediated. The available evidence does not identify an alternative patch or separate mitigation beyond updating the software.

1. Inventory HP Advance servers and determine whether HP AC Print & Scan or HP Output Central is installed.
2. Check the installed version on each server and compare it with the affected boundaries in the record.
3. Identify which servers are network-reachable and review unauthenticated access paths associated with HP Advance.
4. As a precautionary measure, review telemetry for unusual requests and unexpected file changes on HP Advance servers. These are not HP-confirmed indicators of compromise.
5. If suspicious activity is found, preserve logs and other investigative data before changing or updating the system. The absence of suspicious log evidence does not prove that a system is safe, and the available evidence does not identify a specific endpoint or IOC.