Unpatched HP DeskJet 2800 flaw exposes Wi-Fi Direct passwords, CERT/CC warns

CERT/CC disclosed a vulnerability on July 6, 2026, in HP DeskJet 2800 series inkjet printers running firmware TBP1CN2612AR and earlier. Tracked as CVE-2026-13753, the flaw exists because the printer's embedded web server does not check authorization on its backend API. Anyone on the same network can request data that should be limited to administrators, including the Wi-Fi Direct network name and plaintext password, SNMP settings, serial numbers, and cloud registration details. CERT/CC said it was unable to coordinate with HP, and no firmware fix was available at the time of disclosure.

The DeskJet 2800 is a consumer printer, but low-cost inkjets like it can end up in small offices, branch locations, and home offices that connect to company systems. A leaked Wi-Fi Direct password gives an attacker a way onto the printer's wireless connection, and the other data helps map the local network.

If you have these printers, follow the CERT/CC guidance until HP releases a fix: put the printer on a separate network segment or guest network, turn off Wi-Fi Direct if you don't use it, restrict or disable SNMP, and turn off unused cloud and discovery features. For staff working from home, decide whether personal printers should be allowed on the same network as company laptops. Longer term, this is a good reason to standardize on business-class printers with a published security update process.

Security researcher Nguyen Tien Dung reported the flaw.