EUVD-2026-41895
GHSA-mmv4-jxh6-w9r5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network GET (AV:N/AC:L/PR:N/UI:N) leaks Wi‑Fi credentials and device identity giving C:H; no write or availability impact makes I:N/A:N with unchanged scope.
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
3DescriptionCVE.org
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.
AnalysisAI
Information disclosure in HP Deskjet 2800 Series printers running firmware TBP1CN2612AR or earlier lets an unauthenticated attacker on the network read sensitive configuration - including plaintext Wi‑Fi Direct credentials, device identity, and administrative security state - by sending plain GET requests to administrative API endpoints. The same data is gated behind administrator login in the web UI, so these API endpoints bypass the product's own access-control model. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The affected component is the printer's embedded HTTP webserver, which exposes a set of administrative API endpoints alongside the human-facing configuration pages. While the web-interface setting pages enforce an administrator credential check before rendering sensitive values, the underlying API endpoints perform no equivalent authorization check, so those same values are served to any client that requests them directly. Although the input lists CWE as N/A, this is a classic Missing Authorization / Broken Access Control condition (CWE‑862, with elements of CWE‑306 Missing Authentication for a Critical Function and CWE‑200 Exposure of Sensitive Information). The single affected product is identified by CPE cpe:2.3:a:hp_inc.:hp_2800_printer_series:*, i.e. the HP Deskjet 2800 consumer inkjet series firmware stack.
RemediationAI
No vendor-released patch version is identified in the available data; the input specifies only the vulnerable ceiling (TBP1CN2612AR and earlier) with no fixed build, so consult the CERT/CC note at https://kb.cert.org/vuls/id/828543 and HP support for a firmware update and apply it once released. As compensating controls, keep the printer off untrusted and guest networks and place it on an isolated VLAN or dedicated SSID so only trusted hosts can reach its webserver; disable Wi‑Fi Direct when not in use to remove the exposed ad‑hoc network and reduce the value of leaked credentials (trade-off: loss of direct mobile/driverless printing); firewall or block inbound access to the printer's HTTP management port from all but administrative hosts (trade-off: management must then be done from those hosts); and rotate the Wi‑Fi Direct passphrase after remediation since it should be treated as already disclosed.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today