PT-2026-55961 · Hewlett Packard · Deskjet 2800 Series Printers

Nguyá N TiậN Då©Ng · Published 2026-07-06 · Updated 2026-07-06 · CVE-2026-13753

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions HP Deskjet 2800 Series Printers versions prior to TBP1CN2612AR

Description A missing authorization flaw exists in the embedded webserver. An unauthenticated attacker with network access can bypass administrative controls by sending GET requests to multiple exposed administrative API endpoints. This allows the retrieval of sensitive configuration data, including plaintext Wi-Fi Direct credentials, unique device identity information such as serial numbers and service IDs, and other administrative security state details. While the web interface requires administrator credentials to view these pages, the backend API endpoints fail to validate session state or authentication.

Recommendations Update the firmware to a version newer than TBP1CN2612AR. Restrict printer network access to trusted internal segments.

Fix

Related Identifiers

CVE-2026-13753

Affected Products

Deskjet 2800 Series Printers

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-13753 · Security Note
• https://kb.cert.org/vuls/id/828543 · Note
• https://reddit.com/r/SecOpsDaily/comments/1up6xez/vu828543_hp_deskjet_2800_printer_series · Reddit Post