CVE-2026-13753

Certain HP DeskJet All in One – Potential Information Disclosure

View on CVE.org
Published Jul 6, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
References
Type Values Removed Values Added
Description A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed. Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs.
Title CVE-2026-13753 Certain HP DeskJet All in One – Potential Information Disclosure
Weaknesses CWE-703
References
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-200
CWE-284
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
Weaknesses CWE-284
Type Values Removed Values Added
First Time appeared Hp
Hp hp 2800 Printer Series
Vendors & Products Hp
Hp hp 2800 Printer Series
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
Title CVE-2026-13753
References
Earlier changes (12)
Weaknesses

Sources

Status
PUBLISHED
Assigner
certcc
Published
Updated
Aug 31, 2026, 9:22 PM
Reserved
Jun 29, 2026, 4:46 PM

View source JSON

Updated
Jul 6, 2026, 7:33 PM

JSON

Status
Awaiting Analysis
Published
Jul 6, 2026, 7:16 PM
Modified
Oct 25, 2026, 8:10 PM

View source JSON

No data.

Updated
Aug 31, 2026, 10:00 PM

JSON