CVE-2026-13753: HP Deskjet 2800 Missing Authorization – Plaintext Credential Leak

Technical summary

The vulnerability is a missing authorization check in the HP Deskjet 2800 Series embedded web server (firmware ≤TBP1CN2612AR). Specific administrative API endpoints fail to validate authentication or authorization before serving sensitive responses. GET requests to these endpoints return plaintext configuration data including Wi-Fi Direct credentials, device identity information, and administrative state parameters. The discrepancy between the web UI (which enforces authentication) and the API layer (which does not) indicates incomplete security control implementation during development. No user interaction is required; network-adjacent attackers can enumerate and exploit these endpoints passively.

Business impact

Compromise of printer administrative credentials and Wi-Fi Direct secrets could allow an attacker to impersonate the device, intercept or redirect print jobs, access credentials stored on the printer, or pivot into the network using leaked wireless credentials. In offices relying on printers for document handling, this creates both data confidentiality and integrity risks. Printers often sit on shared networks with workstations and servers; credential leakage increases lateral movement risk. Additionally, an attacker with printer control can use it as a staging point for reconnaissance or as a channel to deliver malicious firmware or manipulate printed documents.

Affected systems

HP Deskjet 2800 Series Printers running firmware version TBP1CN2612AR and earlier are vulnerable. Organizations should identify all such devices on their networks and verify their current firmware versions. The vulnerability affects the embedded webserver regardless of network topology, though it requires network-level access to the printer's administrative interface (typically not exposed to the public internet but present on internal or guest Wi-Fi networks).

Exploitability

Exploitability is high. No authentication is required, no user interaction is necessary, and the attack vector is network-based. An attacker with access to the printer's network segment—either through direct connection, compromised endpoint on the same network, or if the printer is exposed to a guest Wi-Fi—can send simple HTTP GET requests to retrieve sensitive data. The CVSS 3.1 score of 7.5 (HIGH) reflects high confidentiality impact with no integrity or availability consequences. The attack is straightforward and does not require special tools or knowledge of exploitation techniques.

Remediation

Apply the latest firmware version provided by HP for the Deskjet 2800 Series. Verify against the HP security advisory that the update addresses this authorization bypass. Until patching is complete, restrict network access to the printer's administrative web interface using network segmentation, VLAN isolation, or firewall rules that limit which devices and users can reach the printer's management port (typically port 80 or 443). Disable the web interface entirely if administrative access is not required, or change default credentials and disable any non-essential remote access features.

Patch guidance

Check the HP support website for firmware updates specific to your Deskjet 2800 Series model number. Download the latest firmware version and follow HP's documented upgrade procedure (typically via the printer's web interface, USB, or network administration tool). Test the patch in a non-critical environment first if possible. After applying the update, verify the firmware version has changed and confirm that the administrative API endpoints now require authentication. Document the patch date and version applied for compliance and audit purposes.

Detection guidance

Network detection: Monitor for unusual HTTP GET requests to the printer's IP address targeting paths like '/admin/api/', '/config/', or similar administrative endpoints from unexpected source IPs. Endpoint detection: If you maintain logs from printer management tools or network scanners, look for authenticated and unauthenticated access to administrative endpoints. Printer log review: Access the printer's internal logs (if available through the web interface) to check for GET requests to sensitive API endpoints. Check for spikes in failed login attempts followed by successful unauthenticated data retrieval. Compare the firmware version on all Deskjet 2800 devices against the patched version to identify vulnerable instances.

Why prioritize this

Although this vulnerability does not currently appear on the CISA Known Exploited Vulnerabilities (KEV) list and is not yet weaponized in the wild, it represents a direct and high-confidence path to sensitive credential disclosure on a commonly deployed device. Printers are often overlooked in security hardening efforts, making them attractive targets for lateral movement and initial reconnaissance. The lack of authentication and the plaintext exposure of Wi-Fi credentials create a material risk to network security posture, particularly in environments where wireless access credentials are shared across multiple devices or where the printer is on the same network segment as critical systems.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Attack Vector (Network)—the vulnerability is exploitable remotely over the network; Attack Complexity (Low)—no special conditions or timing required; Privileges Required (None)—unauthenticated access is sufficient; User Interaction (None)—no user click or action needed; Scope (Unchanged)—only the printer's confidentiality is impacted; Confidentiality Impact (High)—plaintext credentials and device identity are leaked; Integrity Impact (None)—the attacker cannot modify data; Availability Impact (None)—the printer's uptime is not affected. The score reflects the serious but contained nature of the flaw: significant data loss without system compromise or denial of service.

Frequently asked questions