CVE-2026-1997: HP OfficeJet Pro Information Disclosure Flaw

CVE-2026-1997 Overview

CVE-2026-1997 is an information exposure vulnerability affecting certain HP OfficeJet Pro printers. When Cross-Origin Resource Sharing (CORS) is misconfigured on these devices, unauthorized web origins may be able to access device resources, potentially leading to information disclosure. This vulnerability is classified as an Origin Validation Error (CWE-346).

It is important to note that CORS is disabled by default on Pro-class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Organizations that have not explicitly enabled CORS are not affected by this vulnerability.

Critical Impact

Misconfigured CORS settings on affected HP OfficeJet Pro printers may allow malicious websites to bypass same-origin policy restrictions and access sensitive device information when users visit attacker-controlled web pages.

Affected Products

• HP OfficeJet Pro Series Printers (multiple models including M9L65A, D9L20A, K7S32A)
• HP OfficeJet Pro firmware versions (models D9L21A, K7S42A, T0G65A, J6X83A, and others)
• HP OfficeJet Pro Series (models G5J38A, T1P99A, L3T99A, Y0S19A, and additional variants)

Discovery Timeline

• February 10, 2026 - CVE-2026-1997 published to NVD
• February 12, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1997

Vulnerability Analysis

This vulnerability stems from an Origin Validation Error (CWE-346) in the Embedded Web Server (EWS) of affected HP OfficeJet Pro printers. When an administrator explicitly enables CORS through the EWS interface, the implementation may fail to properly validate the origin of incoming requests. This misconfiguration allows web pages from unauthorized domains to make cross-origin requests to the printer's web interface.

The vulnerability is network-accessible and requires no authentication or user interaction to exploit, though the prerequisite is that CORS must have been manually enabled by an administrator. When exploited, this could result in limited information disclosure from the printer device.

Root Cause

The root cause of CVE-2026-1997 lies in improper origin validation within the CORS implementation of the HP OfficeJet Pro Embedded Web Server. When CORS is enabled, the EWS may accept requests from origins that should not be trusted, failing to enforce the same-origin policy effectively. This occurs because the Access-Control-Allow-Origin header configuration does not properly restrict which domains can make cross-origin requests to the printer's web interface.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker could craft a malicious web page that makes cross-origin requests to vulnerable HP OfficeJet Pro printers on the same network. When a user with access to the printer visits the attacker's web page, the malicious JavaScript could:

1. Enumerate printer resources through the EWS interface
2. Extract device configuration information
3. Access potentially sensitive printer settings or job information

The attack does not require the attacker to have direct network access to the printer, as the victim's browser acts as a proxy for the cross-origin requests.

Detection Methods for CVE-2026-1997

Indicators of Compromise

• Unusual cross-origin requests to printer EWS interfaces from external or untrusted domains
• JavaScript-based access attempts to printer API endpoints from web browser contexts
• HTTP requests to printer management interfaces containing suspicious Origin headers
• Log entries showing access to sensitive printer resources from web-based sources

Detection Strategies

• Monitor network traffic for HTTP requests to printer EWS interfaces that include Origin headers from unexpected domains
• Implement web application firewall rules to detect and alert on cross-origin requests to IoT/printer management interfaces
• Review printer access logs for patterns indicating automated enumeration or data extraction
• Deploy network segmentation monitoring to detect cross-VLAN communication to printer devices from user workstations

Monitoring Recommendations

• Enable logging on HP OfficeJet Pro EWS interfaces and forward logs to a centralized SIEM
• Configure network monitoring tools to baseline normal printer communication patterns and alert on anomalies
• Periodically audit CORS configuration status across all HP OfficeJet Pro devices in the environment

How to Mitigate CVE-2026-1997

Immediate Actions Required

• Verify CORS configuration status on all affected HP OfficeJet Pro printers through the Embedded Web Server interface
• Disable CORS on any printers where it is not explicitly required for business operations
• Segment printer networks from general user networks to limit exposure
• Review and restrict administrative access to printer EWS interfaces

Patch Information

HP has released a security bulletin addressing this vulnerability. Administrators should consult the HP Security Bulletin HPSBPI04086 for specific firmware update information and detailed guidance on affected product versions. Apply the latest firmware updates to all affected HP OfficeJet Pro printers as they become available.

Workarounds

• Keep CORS disabled on all HP OfficeJet Pro printers unless explicitly required for trusted web-based print solutions
• Implement network segmentation to isolate printers on a dedicated VLAN, limiting which systems can communicate with printer EWS interfaces
• Use firewall rules to restrict access to printer management interfaces (typically port 80/443) to only authorized administrative workstations
• Consider using HP's built-in security features to restrict EWS access to specific IP addresses

# Network segmentation example - restrict printer access via firewall
# Allow only admin subnet to access printer EWS (adjust IPs as needed)
iptables -A FORWARD -s 10.0.10.0/24 -d 10.0.20.0/24 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 10.0.10.0/24 -d 10.0.20.0/24 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.0.20.0/24 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.0.20.0/24 -p tcp --dport 443 -j DROP