HP DesignJet T3500 CVE-2026-18243

Q: What is the CVSS score of CVE-2026-18243?

CVE-2026-18243 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52344 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-03 hp

GHSA-fvf7-w3m5-7r54

XSS HP Hp Designjet T3500

6.9

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.8 MEDIUM

Adjacent-network only (AV:A); unauthenticated but requires user to actively view the print preview (UI:R); high integrity reflects script-mediated manipulation of printer interface actions.

3.1 AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L

4.0 AV:A/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 17:14 vuln.today

DescriptionCVE.org

Certain HP DesignJet products may be potentially vulnerable to cross-site scripting (XSS), which may allow unauthenticated HTTP requests to view print job previews.

AnalysisAI

Cross-site scripting in HP DesignJet large-format printers allows adjacent-network unauthenticated attackers to inject malicious scripts via crafted HTTP requests that execute when a user views print job previews through the device's embedded web interface. The CVSS 4.0 vector (AV:A/VI:H) constrains the attack to local network adjacency while indicating high integrity impact - consistent with an attacker manipulating displayed print job content or forging actions within the printer's management UI. No public exploit has been identified at time of analysis, and HP has self-disclosed the issue.

Technical ContextAI

HP DesignJet printers, including the T3500 (a large-format inkjet plotter targeting enterprise and creative production environments), expose an embedded HTTP web interface for print job management including preview rendering. The vulnerability is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning the embedded web server fails to sanitize attacker-supplied input before including it in pages rendered in a victim's browser. The CPE string cpe:2.3:a:hp_inc:hp_designjet_t3500:*:*:*:*:*:*:*:* uses a wildcard version field, indicating all known firmware revisions of this model are affected. The CVSS 4.0 adjacent-network attack vector (AV:A) reflects that the printer's web interface is accessible only within the local broadcast domain or subnet - consistent with standard enterprise printer deployment on internal office networks.

RemediationAI

Consult and apply firmware updates detailed in the HP security advisory at https://support.hp.com/us-en/document/ish_15348281-15348304-16. No exact patched firmware version number is independently confirmed from the available data - verify the specific fix release at that advisory before deploying. As compensating controls pending patching: place HP DesignJet printers on a dedicated, isolated VLAN with firewall rules restricting access to authorized print clients and administrators only (this directly addresses the AV:A vector by preventing untrusted network peers from reaching the device). If the printer's web management interface is not needed beyond the local print server, consider blocking HTTP access to the printer at the network layer. Restrict who can submit print jobs on shared devices to reduce the pool of attackers who can inject malicious job metadata. These controls reduce but do not eliminate risk - firmware patching remains the definitive remediation.