CVE-2026-13753: High severity HP Deskjet 2800 Series Printers vulnerability
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
HP Deskjet 2800 Series Printers firmwareto a version that resolves this vulnerability.Fixed in TBP1CN2612AR - Compensating control
Restrict network access to the printer’s embedded webserver/admin API endpoints (e.g., block from untrusted networks/subnets) to prevent unauthenticated GET access to administrative API endpoints.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13753?
CVE-2026-13753 has a high severity level with a CVSS score of 7.5.
How do I fix CVE-2026-13753?
To fix CVE-2026-13753, upgrade the firmware of HP Deskjet 2800 Series Printers to a version higher than TBP1CN2612AR.
What are the potential risks associated with CVE-2026-13753?
The risks associated with CVE-2026-13753 include unauthorized access to sensitive configuration data by unauthenticated attackers on the network.
Which devices are affected by CVE-2026-13753?
CVE-2026-13753 affects HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR or earlier.
What kind of vulnerability is CVE-2026-13753?
CVE-2026-13753 is a missing authorization vulnerability in the embedded webserver of the affected printers.