CVE-2026-13753
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials and unique device identity information.
Risk Assessment
The organization is at risk of leaking sensitive network and device identity data, potentially enabling unauthorized Wi‑Fi access and device impersonation. The attack requires no authentication, increasing the likelihood of exploitation by external attackers.
Recommendation
Immediately update the firmware of HP Deskjet 2800 Series printers to a version newer than TBP1CN2612AR. Until the update is applied, restrict network access to the printer management interface to trusted hosts only.
Original NVD description (English source)
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.