HP OfficeJet Pro 9015 (1MR65A)

HP OfficeJet Pro 9015 (1MR65A)
Security Grade D Calculator v	HP OfficeJet Pro 9015 (1MR65A) Brand: HP Category: Printer • Model / Gen: 1MR65A Release Date: 2019-01-01 • Status: In sale Classification Date:

Security Evaluation

Criterion	Value	Proof	Comment
Known hardware tampering	None	—	No documented hardware tampering on this MFP.
Known vulnerabilities	Rare	—	CVE-2021-39237 / CVE-2021-39238 ('Printing Shellz'), including a wormable RCE. Source: nvd.nist.gov/vuln/detail/CVE-2021-39238
Prior attacks	Rare	—	No in-the-wild exploitation reported at disclosure; the flaw is publicly known and patched. Source: support.hp.com/us-en/document/ish_5000383-5000409-16
Updatability	Very common	—	HP ships regular, automated firmware updates. Source: thehackernews.com/2021/11/critical-wormable-security-flaw-found.html
Category Score	Score: 2 / 3

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	—	Admin is authenticated, but JetDirect 9100/IPP accept unauthenticated print jobs.
Communications	Encrypted with obselete encryption	—	Supports HTTPS, but unencrypted printing protocols (9100/IPP) remain enabled. Source: nvd.nist.gov/vuln/detail/CVE-2021-39238
Storage	No encryption	—	Print/fax jobs and address book stored unencrypted on the internal storage.
Category Score	Score: 3 / 3

Criterion	Value	Proof	Comment
Account management	Basic	—	Single admin account with limited roles.
Authentication	Basic	—	Embedded web server login; no strong per-service authentication.
Brute-force protection	Basic	—	Minimal login throttling on the embedded interface.
Event logging	Partial logging	—	Basic job/usage logging, limited security auditing.
Passwords	Default/Common/Easy to guess	—	Printers commonly retain default admin credentials; no forced change on setup.
Category Score	Score: 3 / 3