Back to overview

CVE-2026-13753

HIGH
7.5
CVSS 3.1
Description
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.

Metadata

CVE ID
CVE-2026-13753
State
PUBLISHED
Assigner
certcc
Reserved
2026-06-29 16:46 UTC
Published
2026-07-06 18:00 UTC
Last updated
2026-07-06 19:33 UTC
Vendor / Product
HP Inc. / HP 2800 Printer Series
Sources
cve.org  ·  NVD

Severity & Metrics

7.5 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
yes
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
HP Inc. HP 2800 Printer Series — 0 ≤ TBP1CN2612AR.
Weakness (CWE)
CWESourceDescription
— cna CWE-862 Missing Authorization
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.5 HIGH 3.1 adp CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References (1)
Back to overview