EUVD-2026-41895
GHSA-mmv4-jxh6-w9r5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin printer LAN or Wi‑Fi Direct network
-
DeliverySend unauthenticated GET to admin API endpoint
-
ExploitServer returns config without authorization check
-
ExecutionHarvest plaintext Wi‑Fi Direct credentials and identity
-
ImpactReuse credentials to pivot on network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Exception handling framework
|
| Exploitation Conditions | Exploitation requires only network reachability to the HP Deskjet 2800's embedded webserver and the ability to issue plain HTTP GET requests to its administrative API endpoints - no credentials, no user interaction, and default configuration are sufficient (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is reachability: as a consumer inkjet the device is typically on a private LAN or its own Wi‑Fi Direct network rather than the public Internet, so the attacker must first be on the same network segment. Exploitation is confined to firmware version TBP1CN2612AR and earlier on the 2800 series, and the impact is limited to reading configuration data (confidentiality only) - there is no write, code-execution, or denial-of-service capability. |
| Impact | The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High) is internally consistent with the description: a fully unauthenticated, low-complexity, network-reachable read of confidential data with no integrity or availability impact. No EPSS score, SSVC decision, KEV entry, or POC reference was supplied, so exploitation-probability signals are absent rather than low - treat 'no public exploit' as unknown, not confirmed-absent. Real-world risk is bounded mainly by network reachability: a Deskjet 2800 is a home/SOHO device usually behind NAT and rarely Internet-exposed, so the practical threat is an attacker already on the same LAN or on the printer's Wi‑Fi Direct network. The C:H rating is defensible because leaked Wi‑Fi Direct credentials can enable further network access, though a stricter reviewer might argue C:L since no print jobs or user documents are exposed - verify the exact leaked fields against the CERT/CC note. |
| Exploit ScenarioDerived | An attacker who joins the same LAN or the printer's Wi‑Fi Direct network - for example a guest on an office or home Wi‑Fi - sends unauthenticated GET requests to the printer's administrative API endpoints and receives its Wi‑Fi Direct passphrase and device identity in plaintext. With those credentials the attacker connects to the device and pivots toward further network reconnaissance. No POC is referenced, but the low attack complexity (AC:L) and lack of authentication (PR:N) make the request trivial to reproduce with a tool like curl. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Information disclosure in HP Deskjet 2800 Series printers running firmware TBP1CN2612AR or earlier lets an unauthenticated attacker on the network read sensitive configuration - including plaintext Wi‑Fi Direct credentials, device identity, and administrative security state - by sending plain GET requests to administrative API endpoints. The same data is gated behind administrator login in the web UI, so these API endpoints bypass the product's own access-control model. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified in the available data; the input specifies only the vulnerable ceiling (TBP1CN2612AR and earlier) with no fixed build, so consult the CERT/CC note at https://kb.cert.org/vuls/id/828543 and HP support for a firmware update and apply it once released. As compensating controls, keep the printer off untrusted and guest networks and place it on an isolated VLAN or dedicated SSID so only trusted hosts can reach its webserver; disable Wi‑Fi Direct when not in use to remove the exposed ad‑hoc network and reduce the value of leaked credentials (trade-off: loss of direct mobile/driverless printing); firewall or block inbound access to the printer's HTTP management port from all but administrative hosts (trade-off: management must then be done from those hosts); and rotate the Wi‑Fi Direct passphrase after remediation since it should be treated as already disclosed.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the printer's embedded HTTP webserver, which exposes a set of administrative API endpoints alongside the human-facing configuration pages. While the web-interface setting pages enforce an administrator credential check before rendering sensitive values, the underlying API endpoints perform no equivalent authorization check, so those same values are served to any client that requests them directly. Although the input lists CWE as N/A, this is a classic Missing Authorization / Broken Access Control condition (CWE‑862, with elements of CWE‑306 Missing Authentication for a Critical Function and CWE‑200 Exposure of Sensitive Information). The single affected product is identified by CPE cpe:2.3:a:hp_inc.:hp_2800_printer_series:*, i.e. the HP Deskjet 2800 consumer inkjet series firmware stack.
Know when Hp 2800 Printer Series gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network GET (AV:N/AC:L/PR:N/UI:N) leaks Wi‑Fi credentials and device identity giving C:H; no write or availability impact makes I:N/A:N with unchanged scope.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
2DescriptionCVE.org
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
Executive ViewAI
HP Deskjet 2800 Series printers running unpatched firmware (TBP1CN2612AR or earlier) expose plaintext Wi-Fi credentials and administrative access to any user on the network, creating an unintended backdoor to organizational wireless and device security controls. This affects organizations with these printers, and no vendor patch is currently available. Immediate network isolation is required to contain this risk pending firmware updates or device replacement.
Isolate affected printers to a dedicated VLAN with network-level access restrictions. Deploy firewall ACLs to block API endpoint access from untrusted network segments. Disable Wi-Fi Direct capability if not required. Monitor administrative interface traffic for unauthorized access attempts. Reset default or shared administrative credentials. Conduct periodic network scans to detect additional affected devices.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB