Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

HP printer webscan lets remote users read scanned documents

CVE-2011-1531 · published 15 years ago
Summary

The webscan feature in the built-in web interface of several HP printers (Photosmart D110, B110, Plus B210, Premium C310, C510, and Envy 100 D410) can be tricked into revealing documents placed on the scanner. This means someone on the network could view sensitive papers without permission. Install the latest HP firmware for the affected models or disable the webscan function if you do not need it.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hp envy_100_d410 All versions
cpe:2.3:h:hp:envy_100_d410:*:*:*:*:*:*:*:*
hp photosmart_b110 All versions
cpe:2.3:h:hp:photosmart_b110:*:*:*:*:*:*:*:*
hp photosmart_d110 All versions
cpe:2.3:h:hp:photosmart_d110:*:*:*:*:*:*:*:*
hp photosmart_plus_b210 All versions
cpe:2.3:h:hp:photosmart_plus_b210:*:*:*:*:*:*:*:*
hp photosmart_premium_c310 All versions
cpe:2.3:h:hp:photosmart_premium_c310:*:*:*:*:*:*:*:*
hp photosmart_premium_c510 All versions
cpe:2.3:h:hp:photosmart_premium_c510:*:*:*:*:*:*:*:*
hp photosmart_premium_fax_all-in-one All versions
cpe:2.3:h:hp:photosmart_premium_fax_all-in-one:*:*:*:*:*:*:*:*
Original advisory text
The webscan component in the Embedded Web Server (EWS) on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows...
The webscan component in the Embedded Web Server (EWS) on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310, Fax All-in-One, and C510; and ENVY 100 D410 printers allows remote attackers to read documents on the scan surface via unspecified vectors.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published15 Apr 2011
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2011-1531 · NVD
Track software like this
Free during beta