What is the CVSS score of CVE-2026-1997?

CVE-2026-1997 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of D9l18a Firmware are affected by CVE-2026-1997?

CVE-2026-1997 presents moderate security risk rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-1997?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

D9l18a Firmware CVE-2026-1997

MEDIUM

Origin Validation Error (CWE-346)

2026-02-10 hp-security-alert@hp.com

CSRF HP D9l18a Firmware D9l20a Firmware D9l21a Firmware D9l63a Firmware D9l64a Firmware G5j38a Firmware G5j56a Firmware J3p65a Firmware J3p66a Firmware J3p67a Firmware J3p68a Firmware J6x76a Firmware J6x77a Firmware J6x78a Firmware J6x79a Firmware J6x80a Firmware J6x81a Firmware J6x83a Firmware K7s32a Firmware K7s37a Firmware K7s38a Firmware K7s39a Firmware K7s40a Firmware K7s41a Firmware K7s42a Firmware K7s43a Firmware L3t99a Firmware M9l65a Firmware M9l66a Firmware M9l67a Firmware M9l70a Firmware T0g46a Firmware T0g47a Firmware T0g48a Firmware T0g49a Firmware T0g56a Firmware T0g65a Firmware T0g70a Firmware T1p99a Firmware Y0s18a Firmware Y0s19a Firmware

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

MEDIUM 5.3

DescriptionCVE.org

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.

CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

AnalysisAI

HP OfficeJet Pro printers (D9l18a, D9l20a, D9l21a, D9l63a firmware) are vulnerable to information disclosure through CORS misconfiguration when administrators enable the feature on the Embedded Web Server. An unauthenticated remote attacker can exploit this to access sensitive device resources from untrusted web origins. CORS remains disabled by default as a mitigation, but organizations that have explicitly enabled it should apply patches when available.

Technical ContextAI

Classified as CWE-346 (Origin Validation Error). Affects M9L65A Firmware. Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.