Unauthorized Access in HP Deskjet 2800 Series Printers by Embedded Webserver

CVE-2026-13753

What is CVE-2026-13753?

CVE-2026-13753 is a vulnerability found in the embedded webserver of HP Deskjet 2800 Series Printers. These printers are designed for home and small office use, providing essential printing functions directly from a user’s device or network. The vulnerability arises due to a lack of appropriate authorization controls, allowing unauthorized attackers with network access to execute GET requests against several administrative API endpoints. This oversight can lead to the exposure of sensitive configuration data, such as unencrypted Wi-Fi Direct credentials and critical device information, which would typically require administrative authentication to access. Without proper safeguards, a malicious actor could exploit this vulnerability to gain insights into the printer's security settings and network configurations, potentially facilitating further attacks on the network.

Potential impact of CVE-2026-13753

1. Data Exposure: The vulnerability allows unauthorized users to retrieve sensitive configuration information, including plaintext credentials. This can lead to unauthorized access to the printer and potentially the wider network, as these credentials may grant access to secure networks.

2. Increased Attack Surface: By exposing sensitive information such as device identity and administrative details, the vulnerability can significantly increase the risk of targeted attacks. Attackers may leverage this data to initiate further exploits against connected systems and devices.

3. Compromised Network Security: With the potential for unauthorized access to sensitive configurations, this vulnerability poses a risk to overall network security. Compromised printers can serve as entry points for broader attacks, impacting the integrity and confidentiality of organizational data across the network.

References