The computer manufacturer Hewlett Packard has released a security patch for two (2) critical vulnerabilities that impact more than 150 models including HP LaserJet, PageWide, and ScanJet lines. The first vulnerability, tracked as CVE-2021-39238, is a buffer overflow within HP printers’ font parser, and if exploited this flaw can allow attackers to execute malicious code remotely. CVE-2021-39238 is also described as “wormable,” meaning that it can self-replicate and spread to other systems, and even take full control of those systems as a botnet. The second vulnerability, tracked as CVE-2021-39237, exists due to exposed ports that could allow an attacker to take full control of the targeted system, however this flaw is much less severe due to the attacker needing physical access to the system. HP users are urged to upgrade the firmware on their devices to the latest secure versions, and if that isn’t possible then there are mitigation techniques that administrators can use like disabling the ability to print from USB, placing the printer behind a firewall, and disabling outbound communication. The Ankura CTAPT will continue to publish information on the latest device vulnerabilities.