# Hacking HP Display Monitors via Monitor Control Command Set (CVE-2023-5449)

HP monitors store anti-theft PIN in read-write VCP controls 252/253, letting anyone read the PIN over DDC/CI and unlock a stolen monitor.

- Payout: Research
- Severity: medium
- Program: HP monitors
- Write-up by: Eugene Lim
- Disclosed: 2023-10-31
- CVE: CVE-2023-5449
- Write-up quality: 7/10
- Original: https://spaceraccoon.dev/hacking-display-monitors-monitor-command-control-set/
- Library page: https://bugbountylibrary.com/r/blog%3Aspaceraccoon-dev-hacking-display-monitors-monitor-command-control-set
- Tags: area:devices domain:iot impact:data-leak impact:integrity kind:research platform:research sev:medium technique:reverse-engineering technique:source-review vuln:access-control vuln:info-disclosure vuln:misconfiguration

**Target:** HP Display Center software and monitor firmware MCCS VCP controls over DDC/CI
**Root cause:** TheftLowPin (252) and TheftHighPin (253) VCP controls are configured read-write instead of write-only, so the stored PIN can be read back over MCCS.
**Steps:**
1. Set PIN 123123 and enable anti-theft in HP Display Center Advanced tab
2. Move monitor to another computer (5 min before theft mode triggers)
3. Run `ddcset -b winapi getvcp 252` to read TheftLowPin (returns 123)
4. Run `ddcset -b winapi getvcp 253` to read TheftHighPin (returns 123)
5. Enter leaked PIN in HP Display Center to disable theft mode
**How found:** Noticed HP Display Center auto-installed and could control monitors from other vendors; reversed the .NET app to find ExecuteSetVcp calls, learned MCCS/VCP, then explored proprietary VCP codes via GUI debugging and logging, spotting the theft-deterrence feature and its PIN controls.
**Exploitation:** Attacker with physical access to a stolen monitor connects it to their own computer and uses ddcset to read VCP 252/253, recovering the PIN, then enters it in HP Display Center to disable theft deterrence.
**Insight:** Vendor-specific VCP codes (0xE0-0xFF) and sub-VCP catch-all codes are under-audited; check whether security-relevant values like PINs are marked write-only or leak via read commands, and reverse the vendor client rather than firmware.