CVE-2020-28416

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

HP has identified a security vulnerability with the I.R.I.S. OCR (Optical Character Recognition) software available with HP PageWide and OfficeJet printer software installations that could potentially allow unauthorized local code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
n/aHP OfficeJet Printer; HP PageWide Printerbefore 33.1.74; before 35.0.72; before 38.8.1942; before 38.9.1948; before 39.6.1999; before 39.6.2002; before 40.11.1122; before 40.11.1148; before 40.11.1150; before 40.12.1161; before 40.13.1176; before 40.7.1094

References

Timeline

Published
Nov 3, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-284198.8During installation with certain driver software or application packages an arbitrary code execution could occur.CVE-2020-28428.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284217.8CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackeCVE-2020-284227.8All versions of package git-archive are vulnerable to Command Injection via the exports function.CVE-2020-284239.8This affects all versions of package monorepo-build.CVE-2020-284249.8This affects all versions of package s3-kilatstorage.CVE-2020-284259.8This affects all versions of package curljs.CVE-2020-284267.3All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.CVE-2020-284299.8All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","&CVE-2020-28438.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Supported versions that are affected are 12.1.CVE-2020-284339.8This affects all versions of package node-latex-pdf.CVE-2020-284349.8This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.
CVE-2020-28416: High severity, CVSS 7.8 | Vulnix