CVE-2026-13753: CWE-862 Missing Authorization in HP Inc. HP 2800 Printer Series
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
AI Analysis
Technical Summary
This vulnerability (CWE-862) affects HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR or earlier. The embedded webserver fails to enforce authorization on certain administrative API endpoints, allowing unauthenticated network attackers to access sensitive configuration data such as plaintext Wi-Fi Direct credentials and device identity information. Although the web interface requires administrator credentials to view these settings, the exposed API endpoints do not, leading to unauthorized data disclosure. No vendor advisory or patch is currently confirmed, and no known exploits are reported in the wild.
Potential Impact
An attacker with network access can retrieve sensitive administrative configuration data without authentication. This includes plaintext Wi-Fi Direct credentials and unique device identity information, potentially enabling unauthorized network access or device impersonation. The vulnerability does not impact system integrity or availability but results in high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/828543 for current remediation guidance. Until a fix is available, restrict network access to the printer's management interfaces to trusted users only to reduce exposure.
CVE-2026-13753: CWE-862 Missing Authorization in HP Inc. HP 2800 Printer Series
Description
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
CVSS v3.1
Score 7.5high
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-862) affects HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR or earlier. The embedded webserver fails to enforce authorization on certain administrative API endpoints, allowing unauthenticated network attackers to access sensitive configuration data such as plaintext Wi-Fi Direct credentials and device identity information. Although the web interface requires administrator credentials to view these settings, the exposed API endpoints do not, leading to unauthorized data disclosure. No vendor advisory or patch is currently confirmed, and no known exploits are reported in the wild.
Potential Impact
An attacker with network access can retrieve sensitive administrative configuration data without authentication. This includes plaintext Wi-Fi Direct credentials and unique device identity information, potentially enabling unauthorized network access or device impersonation. The vulnerability does not impact system integrity or availability but results in high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/828543 for current remediation guidance. Until a fix is available, restrict network access to the printer's management interfaces to trusted users only to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- certcc
- Date Reserved
- 2026-06-29T16:46:12.558Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://kb.cert.org/vuls/id/828543","vendor":"CERT"}]
Threat ID: 6a4bf27c27e9c79719fa4088
Added to database: 07/06/2026, 18:22:52 UTC
Last enriched: 07/14/2026, 08:45:01 UTC
Last updated: 08/20/2026, 17:07:37 UTC
Views: 182
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.