Hp Deskjet 2800E All In One Printer Series CVE-2026-4682

Q: What is the CVSS score of CVE-2026-4682?

CVE-2026-4682 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-22949 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-04-15 hp

GHSA-r28v-qhr5-pj8w

RCE Buffer Overflow Microsoft Stack Overflow HP Hp Deskjet 2800E All In One Printer Series Hp Deskjet 4200 All In One Printer Series Hp Deskjet Ink Advantage 4200 All In One Printer Series Hp Deskjet 4200E All In One Printer Series Hp Deskjet Ink Advantage Ultra 4900 Series Hp Deskjet Ink Advantage 2800 All In One Printer Series Hp Inc

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:32 vuln.today

CVSS changed

Apr 15, 2026 - 15:22 NVD

8.7 (HIGH)

EUVD ID Assigned

Apr 15, 2026 - 15:00 euvd

EUVD-2026-22949

CVE Published

Apr 15, 2026 - 14:32 nvd

HIGH 8.7

DescriptionCVE.org

Certain HP DeskJet All in One devices may be vulnerable to remote code execution caused by a buffer overflow when specially crafted Web Services for Devices (WSD) scan requests are improperly validated and handled by the MFP.

WSD Scan is a Microsoft Windows-based network scanning protocol that allows a PC to discover scanners (and MFPs) on a network and send scan jobs to them without requiring vendor specific drivers or utilities.

AnalysisAI

Remote code execution in HP DeskJet All-in-One printers via malformed WSD scan requests allows adjacent network attackers to fully compromise the device. A stack-based buffer overflow (CWE-121) in the MFP's processing of Web Services for Devices (WSD) scan jobs enables unauthenticated arbitrary code execution. No active exploitation or public proof-of-concept has been reported, and EPSS predicts low exploitation likelihood.