CVE-2026-1997 | THREATINT

Description

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

PUBLISHED Reserved 2026-02-05 | Published 2026-02-10 | Updated 2026-02-10 | Assigner hp

MEDIUM: 6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Problem types

CWE-346

Product status

Default status

unaffected

Any version before <001.2602B

affected

Default status

unaffected

Any version before <001.2602B

affected

Default status

unaffected

Any version before <001.2602B

affected

Default status

unaffected

Any version before <001.2602B

affected

Default status

unaffected

Any version before <002.2602A

affected

Default status

unaffected

Any version before <002.2602A

affected

Default status

unaffected

Any version before <002.2602A

affected

Default status

unaffected

Any version before <001.2602A

affected

References

support.hp.com/...ument/ish_14051823-14051849-16/hpsbpi04086

cve.org (CVE-2026-1997)

nvd.nist.gov (CVE-2026-1997)

Download JSON