Skip to main content

CISA issues update on HP Deskjet 2800 authorization bypass

Source Decision Insights Threat Desk Published August 23, 2026 Companies 1
Human View Machine View

46th article in the last 90 days, one of 589 articles referencing Cybersecurity and Infrastructure Security Agency (CISA). Previous coverage: CISA warns PayRange Android 7.0.7 has TLS and WebView issues (Aug 2026).

Companies mentioned

Best suited for

Seniority
Analyst
Job function
Cybersecurity / Security Analyst
Persona
Security Operations Leader
Buyer role
Technical Implementer / Administrator
Decision stage
How to start
Adoption curve
Early Majority
Technology maturity
Emerging Exploration
Industry
Industrials / Capital Goods / Electrical Equipment

Our classification, not the publisher's statement. Best suited for, not only for.

HP Printers in the Deskjet 2800 Series running firmware version TBP1CN2612AR contain a missing authorization flaw. The issue permits unauthenticated access to the printer’s webserver API endpoints and enables remote access to sensitive configuration and security-related data normally restricted to administrative users.

The vulnerability is tracked as CVE-2026-13753. In affected firmware versions, authorization can be bypassed by sending direct, unauthenticated GET requests to multiple backend API endpoints. The endpoints return administrative configuration data without validating session state or authentication, including the Wi-Fi Direct SSID and plaintext passphrase, unique printer serial numbers and service IDs, and details about the device’s administrative password state. Although the corresponding web interface pages correctly enforce authentication, the disclosed data indicates an authorization flaw in the API layer. The issue exposes Wi-Fi credentials, management configuration details, and sensitive security data through the affected webserver API endpoints.

A remote attacker with network access to the printer can bypass the web interface’s authentication requirements and retrieve sensitive configuration data directly from backend APIs. Exposed information includes Wi-Fi Direct credentials, SNMP configuration details, device identity information, cloud service registration metadata, and other information involving the device’s administrative security state. The attacker could gain unauthorized wireless access, perform reconnaissance on network or cloud integrations, impersonate the device, or facilitate further compromise of the printing environment.

No firmware patch is available because HP was not reachable to coordinate the vulnerability. To limit risk, users are instructed to restrict network access to the printer’s web interface by placing the device on a trusted or isolated network segment, disable Wi‑Fi Direct if it is not required, and limit SNMP access to trusted systems or disable it entirely. The guidance also states that firewall or access-control list (ACL) rules should prevent untrusted hosts from reaching the printer’s management ports, and that discovery or cloud service features not needed should be disabled.

Thanks to Nguyễn Tiến Dũng for researching and reporting this vulnerability. The document was written by Molly Jaconski. CISA lists CVE-2026-13753, with a date public of 2026-07-06 and a date last updated of 2026-07-06 18:01 UTC, and specifies document revision 2.

Blog post, originally published by Molly Jaconski at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-update-on-hp-deskjet-2800-authorization-bypass/",
        "name": "CISA issues update on HP Deskjet 2800 authorization bypass",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-update-on-hp-deskjet-2800-authorization-bypass/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
      "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
    },
    "articleSection": [
      "Cybersecurity",
      "AI infrastructure",
      "Data Center",
      "Network Operator"
    ],
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Security Analyst"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Technical Implementer / Administrator"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Emerging Exploration"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Industrials / Capital Goods / Electrical Equipment"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T22:00:12-06:00",
    "datePublished": "2026-08-23T09:44:09-06:00",
    "description": "CVE-2026-13753 affects HP Deskjet 2800 firmware TBP1CN2612AR by allowing unauthenticated access to webserver API endpoints and exposed credentials.",
    "headline": "CISA issues update on HP Deskjet 2800 authorization bypass",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Molly Jaconski"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/828543"
    },
    "keywords": [
      "Access Control List",
      "Authentication",
      "Authorization",
      "Cloud",
      "Firmware",
      "Vulnerabilities",
      "Wi-Fi"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-update-on-hp-deskjet-2800-authorization-bypass/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-24",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages