CVE-2026-1997
Analyzed Analyzed - Analysis Complete
CORS Misconfiguration in HP OfficeJet Pro Enables Data Exposure

Publication date: 2026-02-10

Last updated on: 2026-02-12

Assigner: HP Inc.

Description
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-10
Last Modified
2026-02-12
Generated
2026-06-16
AI Q&A
2026-02-10
EPSS Evaluated
2026-06-14
NVD
CVE-2026-1997
Affected Vendors & Products
Showing 41 associated CPEs
Vendor Product Version / Range
hp m9l65a_firmware to 001.2602a (exc)
hp d9l20a_firmware to 001.2602b (exc)
hp k7s32a_firmware to 001.2602b (exc)
hp d9l21a_firmware to 001.2602b (exc)
hp k7s42a_firmware to 001.2602b (exc)
hp t0g65a_firmware to 001.2602b (exc)
hp k7s39a_firmware to 001.2602b (exc)
hp j6x83a_firmware to 001.2602b (exc)
hp k7s43a_firmware to 001.2602b (exc)
hp k7s40a_firmware to 001.2602b (exc)
hp k7s41a_firmware to 001.2602b (exc)
hp t0g56a_firmware to 001.2602b (exc)
hp d9l63a_firmware to 001.2602b (exc)
hp d9l64a_firmware to 001.2602b (exc)
hp j3p65a_firmware to 001.2602b (exc)
hp j3p66a_firmware to 001.2602b (exc)
hp j3p67a_firmware to 001.2602b (exc)
hp j3p68a_firmware to 001.2602b (exc)
hp t0g70a_firmware to 001.2602b (exc)
hp g5j38a_firmware to 001.2602a (exc)
hp t1p99a_firmware to 001.2602a (exc)
hp l3t99a_firmware to 001.2602a (exc)
hp y0s19a_firmware to 001.2602a (exc)
hp g5j56a_firmware to 001.2602a (exc)
hp y0s18a_firmware to 001.2602a (exc)
hp d9l18a_firmware to 001.2602a (exc)
hp m9l66a_firmware to 001.2602a (exc)
hp m9l67a_firmware to 001.2602a (exc)
hp t0g46a_firmware to 001.2602a (exc)
hp j6x76a_firmware to 001.2602a (exc)
hp j6x78a_firmware to 001.2602a (exc)
hp j6x80a_firmware to 001.2602a (exc)
hp k7s37a_firmware to 001.2602a (exc)
hp m9l70a_firmware to 001.2602a (exc)
hp j6x77a_firmware to 001.2602a (exc)
hp j6x81a_firmware to 001.2602a (exc)
hp j6x79a_firmware to 001.2602a (exc)
hp k7s38a_firmware to 001.2602a (exc)
hp t0g47a_firmware to 001.2602a (exc)
hp t0g48a_firmware to 001.2602a (exc)
hp t0g49a_firmware to 001.2602a (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves certain HP OfficeJet Pro printers that may expose information if Cross-Origin Resource Sharing (CORS) is misconfigured.

CORS is a security feature that controls how web resources are shared between different origins. In this case, if CORS is enabled improperly, unauthorized web origins could access device resources.

By default, CORS is disabled on these Pro-class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

Impact Analysis

If CORS is misconfigured and enabled on the affected HP OfficeJet Pro printers, unauthorized web origins could potentially access sensitive device resources.

This could lead to exposure of information stored or processed by the printer, which might be exploited by attackers to gain unauthorized access or gather sensitive data.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, ensure that Cross-Origin Resource Sharing (CORS) is disabled on your HP OfficeJet Pro printers unless explicitly required.

Since CORS is disabled by default and can only be enabled by an administrator through the Embedded Web Server (EWS), verify that no unauthorized changes have been made to enable CORS.

Keeping CORS disabled helps ensure that only trusted solutions can interact with the device and prevents unauthorized web origins from accessing device resources.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart