CVE-2026-13753 is a missing authorization vulnerability (CWE-862) affecting HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR or earlier. The embedded webserver exposes multiple administrative API endpoints that do not enforce authentication, enabling unauthenticated attackers with network access to send GET requests and retrieve sensitive configuration details such as plaintext Wi‑Fi Direct credentials and device identity information. This bypasses the intended authentication controls present in the web interface for these settings.

An unauthenticated attacker on the network can obtain sensitive administrative configuration data, including plaintext Wi‑Fi Direct credentials and unique device identity information. This exposure could facilitate further network attacks or unauthorized access to the printer and connected resources. The vulnerability compromises confidentiality of sensitive device information due to missing authorization checks on API endpoints.

Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/828543 for current remediation guidance. Until a fix is available, restrict network access to the printer's management interfaces to trusted users only and monitor for unauthorized access attempts. Avoid exposing the printer's administrative interfaces to untrusted networks.