Missing authorization vulnerability in HP Deskjet 2800 Series Printers embedded webserver that exposes sensitive configuration data through unauthenticated access to administrative API endpoints. An attacker can retrieve plaintext Wi-Fi Direct credentials, unique device identity information, and other administrative security state details that are normally protected when accessed through the web interface.
An unauthenticated attacker with network access can send GET requests to administrative API endpoints to retrieve sensitive configuration data including plaintext Wi-Fi Direct credentials, device identity information, and administrative security state details.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Update HP Deskjet 2800 Series Printers to firmware version greater than TBP1CN2612AR. Restrict network access to the printer's embedded webserver to trusted networks only. Disable remote administrative access if not required. Monitor for unauthorized API requests to administrative endpoints.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Feedly found the first article mentioning CVE-2026-13753 . See article
NVD published the first details for CVE-2026-13753
A CVSS base score of 7.5 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-mmv4-jxh6-w9r5] A missing authorization vulnerability exists in the embedded webserver of HP Des
CVE-2026-13753 - Exploits & Severity - Feedly
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
