CVE-2026-1997
Certain HP OfficeJet Pro Printers - Information Disclosure
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Certain HP OfficeJet Pro Printers - Information Disclosure
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
- Record
CVE-2026-1997- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-346
- Updated
- 2026-11-02
EUVDEUVD-2026-6735
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
- Record
EUVD-2026-6735- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-993x-2cg3-pv23
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS)...
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
- Record
GHSA-993x-2cg3-pv23- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
NVD
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.
CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
- Record
CVE-2026-1997- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-346
- Updated
- 2026-11-02
Affected products
- hp d9l18a firmware
- hp d9l20a firmware
- hp d9l21a firmware
- hp d9l63a firmware
- hp d9l64a firmware
- hp g5j38a firmware
- hp g5j56a firmware
- hp j3p65a firmware
- hp j3p66a firmware
- hp j3p67a firmware
- hp j3p68a firmware
- hp j6x76a firmware
Show 37 moreShow less
- hp j6x77a firmware
- hp j6x78a firmware
- hp j6x79a firmware
- hp j6x80a firmware
- hp j6x81a firmware
- hp j6x83a firmware
- hp k7s32a firmware
- hp k7s37a firmware
- hp k7s38a firmware
- hp k7s39a firmware
- hp k7s40a firmware
- hp k7s41a firmware
- hp k7s42a firmware
- hp k7s43a firmware
- hp l3t99a firmware
- hp m9l65a firmware
- hp m9l66a firmware
- hp m9l67a firmware
- hp m9l70a firmware
- hp t0g46a firmware
- hp t0g47a firmware
- hp t0g48a firmware
- hp t0g49a firmware
- hp t0g56a firmware
- hp t0g65a firmware
- hp t0g70a firmware
- hp t1p99a firmware
- hp y0s18a firmware
- hp y0s19a firmware
- hp inc officejet pro 7720 wide format all-in-one printer series
- hp inc officejet pro 7730 wide format all-in-one printer
- hp inc officejet pro 7740 wide format all-in-one printer series
- hp inc officejet pro 8210 printer series
- hp inc officejet pro 8710 all-in-one printer series
- hp inc officejet pro 8730 all-in-one printer
- hp inc officejet pro 8730 mono printer series
- hp inc officejet pro 8740 all-in-one printer series
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-1997 is a medium vulnerability (CVSS 6.9) in Hp D9l18a Firmware, published February 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. No source names a fixed version.