CVE-2026-13753: CWE-703 in HP Inc HP DeskJet 2820 AIO Printer

This vulnerability (CWE-862) affects HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR or earlier. The embedded webserver fails to enforce authorization on certain administrative API endpoints, allowing unauthenticated network attackers to access sensitive configuration data such as plaintext Wi-Fi Direct credentials and device identity information. Although the web interface requires administrator credentials to view these settings, the exposed API endpoints do not, leading to unauthorized data disclosure. No vendor advisory or patch is currently confirmed, and no known exploits are reported in the wild.

An attacker with network access can retrieve sensitive administrative configuration data without authentication. This includes plaintext Wi-Fi Direct credentials and unique device identity information, potentially enabling unauthorized network access or device impersonation. The vulnerability does not impact system integrity or availability but results in high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/828543 for current remediation guidance. Until a fix is available, restrict network access to the printer's management interfaces to trusted users only to reduce exposure.