A command injection vulnerability in HP Linux Imaging and Printing Software (HPLIP) allows local authenticated attackers to execute arbitrary system commands.

The software fails to properly neutralize special elements used in commands (CWE-77), leading to a command injection vulnerability. The attack vector requires local access and low privileges to trigger the flaw.

Successful exploitation allows a local user to execute commands with the privileges of the HPLIP service. This could lead to full system compromise if the service runs with elevated permissions, facilitating lateral movement or data theft within the local environment. The CVSS score of 7.8 underscores the significant risk of local privilege escalation.

Immediate Action: Update the HP Linux Imaging and Printing Software to version 3.26.4 or later immediately.

Proactive Monitoring: Monitor system logs for unusual command execution patterns or unauthorized attempts to access print service configuration files.

Compensating Controls: Restrict local user access to the system and ensure that print services are running with the principle of least privilege.

Public Exploit Available: No confirmed public exploit (e.g., Metasploit/ExploitDB) available in the provided data.

Administrators should treat this vulnerability with high priority by applying the vendor-supplied update to version 3.26.4. Systems utilizing HPLIP should be patched to prevent potential local privilege escalation and subsequent system compromise.