CVE-2026-13753: HP Deskjet 2800 Information Disclosure

CVE-2026-13753 Overview

CVE-2026-13753 is a missing authorization vulnerability in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR and earlier. The embedded webserver exposes administrative API endpoints that respond to unauthenticated HTTP GET requests. An attacker with network access can retrieve sensitive configuration data, including plaintext Wi-Fi Direct credentials, unique device identity information, and administrative security state details. The web interface enforces administrator credentials before displaying these settings pages, but the underlying API endpoints skip the authorization check. This inconsistency allows unauthenticated adversaries on the same network to harvest credentials that can be used to pivot into wireless networks or fingerprint devices.

Critical Impact
Unauthenticated network attackers can retrieve plaintext Wi-Fi Direct credentials and device identity data from affected HP Deskjet 2800 Series printers.

Affected Products

HP Deskjet 2800 Series Printers
Firmware version TBP1CN2612AR and earlier
Embedded webserver administrative API endpoints

Discovery Timeline

2026-07-06 - CVE-2026-13753 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-13753

Vulnerability Analysis

The embedded webserver in HP Deskjet 2800 Series printers exposes administrative functionality through two distinct interfaces. The HTML settings pages enforce administrator authentication before rendering sensitive data. The underlying REST-style API endpoints, however, accept unauthenticated GET requests and return the same data in structured form. This inconsistent authorization enforcement classifies the flaw as Missing Authorization, aligned with [CWE-862].

An attacker with network reachability to the printer sends direct HTTP GET requests to the affected endpoints. The server returns configuration objects containing Wi-Fi Direct pre-shared keys, device serial identifiers, and administrative security state fields. No credentials, tokens, or session state are required. The attack requires no user interaction and can be automated across a subnet.

Root Cause

The root cause is inconsistent access control between the web UI presentation layer and the backend API. The presentation layer performs authorization checks in the client-side rendering path, while the API handlers do not validate the session before returning data. Server-side authorization should be enforced on every endpoint that exposes sensitive configuration state.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker on the same LAN, or one that reaches the printer through a routed or bridged network, issues GET requests to the exposed administrative endpoints. Wi-Fi Direct credentials disclosed through this flaw enable direct wireless association with the printer, bypassing network segmentation controls. Device identity information supports fingerprinting for follow-on attacks.

No verified public exploit code is available at this time. Technical details are documented in the CERT Vulnerability Advisory #828543.

Detection Methods for CVE-2026-13753

Indicators of Compromise

Unauthenticated HTTP GET requests to administrative API paths on printer IP addresses from unexpected internal hosts
Repeated requests from a single source enumerating multiple administrative endpoints on the printer
Unexpected Wi-Fi Direct client associations to the printer from unmanaged devices

Detection Strategies

Inspect network flow logs for HTTP traffic to printer management interfaces originating from user workstations or unmanaged hosts
Monitor printer embedded webserver access logs, if available, for GET requests to administrative API endpoints without prior authenticated session establishment
Correlate printer API access with subsequent Wi-Fi Direct authentication attempts to identify credential reuse

Monitoring Recommendations

Enable NetFlow or IPFIX collection on network segments that host printers and forward records to a centralized data lake
Alert on lateral scanning behavior targeting TCP/80 and TCP/443 on printer VLANs
Track firmware version inventories for HP Deskjet 2800 Series devices to identify unpatched units

How to Mitigate CVE-2026-13753

Immediate Actions Required

Isolate HP Deskjet 2800 Series printers on a dedicated management VLAN with restricted inbound access
Rotate any Wi-Fi Direct pre-shared keys that may have been exposed on affected devices
Inventory affected devices and confirm firmware version against TBP1CN2612AR

Patch Information

HP has not published a fixed firmware version in the referenced advisory data. Administrators should monitor HP support channels and the CERT Vulnerability Advisory #828543 for updated remediation guidance and apply firmware updates as soon as they are released.

Workarounds

Disable the embedded webserver on affected printers if the feature is not required for daily operations
Block inbound HTTP and HTTPS access to printer management interfaces from user network segments using ACLs or host-based firewalls
Disable Wi-Fi Direct on affected printers to eliminate the value of leaked credentials
Restrict printer management to a dedicated administrative subnet accessible only through jump hosts

bash

# Example ACL restricting access to printer management interface
access-list PRINTER_MGMT deny tcp any host <printer_ip> eq 80
access-list PRINTER_MGMT deny tcp any host <printer_ip> eq 443
access-list PRINTER_MGMT permit tcp host <admin_jump_host> host <printer_ip> eq 443