CVE-2020-28419

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

During installation with certain driver software or application packages an arbitrary code execution could occur.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
n/aHP LaserJet Printer; HP LaserJet Pro Printer; HP PageWide Printer; HP PageWide Pro Printer; HP inkjet Printer; HP OfficeJet Printerbefore 61.111.01.9108; before 8.0.13284.929; before 11.0.19232.882; before 52.1.4899; before 14.0.19241.351; before 14.0.19232.485; before 10.0.16007.5; before 9.0.15316.203; before 11.0.16058.821; before 50.1.4584; before 16.0.19235.653; before 16.0.19233.658; before 10.0.15324.194; before 10.0.15324.199; before 49.1.4431; before 43.2.2509; before 49.1.4424; before 50.1.4533; before 44.7.2713; before 44.6.2710

References

Timeline

Published
Nov 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-28428.2Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). Supported versions thaCVE-2020-284217.8CA Unified Infrastructure Management 20.1 and earlier contains a vulnerability in the robot (controller) component that allows local attackeCVE-2020-284227.8All versions of package git-archive are vulnerable to Command Injection via the exports function.CVE-2020-284239.8This affects all versions of package monorepo-build.CVE-2020-284249.8This affects all versions of package s3-kilatstorage.CVE-2020-284259.8This affects all versions of package curljs.CVE-2020-284267.3All versions of package kill-process-on-port are vulnerable to Command Injection via a.getProcessPortId.CVE-2020-284299.8All versions of package geojson2kml are vulnerable to Command Injection via the index.js file. PoC: var a =require("geojson2kml"); a("./","&CVE-2020-28438.2Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Profile). Supported versions that are affected are 12.1.CVE-2020-284339.8This affects all versions of package node-latex-pdf.CVE-2020-284349.8This affects all versions of package gitblame. The injection point is located in line 15 in lib/gitblame.js.CVE-2020-284359.8This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
CVE-2020-28419: High severity, CVSS 8.8 | Vulnix