6.9

CVE-2026-1997

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource.

CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Hp ≫ M9l65a Firmware Version < 001.2602a
   Hp ≫ M9l65a Version-
Hp ≫ D9l20a Firmware Version < 001.2602b
   Hp ≫ D9l20a Version-
Hp ≫ K7s32a Firmware Version < 001.2602b
   Hp ≫ K7s32a Version-
Hp ≫ D9l21a Firmware Version < 001.2602b
   Hp ≫ D9l21a Version-
Hp ≫ K7s42a Firmware Version < 001.2602b
   Hp ≫ K7s42a Version-
Hp ≫ T0g65a Firmware Version < 001.2602b
   Hp ≫ T0g65a Version-
Hp ≫ K7s39a Firmware Version < 001.2602b
   Hp ≫ K7s39a Version-
Hp ≫ J6x83a Firmware Version < 001.2602b
   Hp ≫ J6x83a Version-
Hp ≫ K7s43a Firmware Version < 001.2602b
   Hp ≫ K7s43a Version-
Hp ≫ K7s40a Firmware Version < 001.2602b
   Hp ≫ K7s40a Version-
Hp ≫ K7s41a Firmware Version < 001.2602b
   Hp ≫ K7s41a Version-
Hp ≫ T0g56a Firmware Version < 001.2602b
   Hp ≫ T0g56a Version-
Hp ≫ D9l63a Firmware Version < 001.2602b
   Hp ≫ D9l63a Version-
Hp ≫ D9l64a Firmware Version < 001.2602b
   Hp ≫ D9l64a Version-
Hp ≫ J3p65a Firmware Version < 001.2602b
   Hp ≫ J3p65a Version-
Hp ≫ J3p66a Firmware Version < 001.2602b
   Hp ≫ J3p66a Version-
Hp ≫ J3p67a Firmware Version < 001.2602b
   Hp ≫ J3p67a Version-
Hp ≫ J3p68a Firmware Version < 001.2602b
   Hp ≫ J3p68a Version-
Hp ≫ T0g70a Firmware Version < 001.2602b
   Hp ≫ T0g70a Version-
Hp ≫ G5j38a Firmware Version < 001.2602a
   Hp ≫ G5j38a Version-
Hp ≫ T1p99a Firmware Version < 001.2602a
   Hp ≫ T1p99a Version-
Hp ≫ L3t99a Firmware Version < 001.2602a
   Hp ≫ L3t99a Version-
Hp ≫ Y0s19a Firmware Version < 001.2602a
   Hp ≫ Y0s19a Version-
Hp ≫ G5j56a Firmware Version < 001.2602a
   Hp ≫ G5j56a Version-
Hp ≫ Y0s18a Firmware Version < 001.2602a
   Hp ≫ Y0s18a Version-
Hp ≫ D9l18a Firmware Version < 001.2602a
   Hp ≫ D9l18a Version-
Hp ≫ M9l66a Firmware Version < 001.2602a
   Hp ≫ M9l66a Version-
Hp ≫ M9l67a Firmware Version < 001.2602a
   Hp ≫ M9l67a Version-
Hp ≫ T0g46a Firmware Version < 001.2602a
   Hp ≫ T0g46a Version-
Hp ≫ J6x76a Firmware Version < 001.2602a
   Hp ≫ J6x76a Version-
Hp ≫ J6x78a Firmware Version < 001.2602a
   Hp ≫ J6x78a Version-
Hp ≫ J6x80a Firmware Version < 001.2602a
   Hp ≫ J6x80a Version-
Hp ≫ K7s37a Firmware Version < 001.2602a
   Hp ≫ K7s37a Version-
Hp ≫ M9l70a Firmware Version < 001.2602a
   Hp ≫ M9l70a Version-
Hp ≫ J6x77a Firmware Version < 001.2602a
   Hp ≫ J6x77a Version-
Hp ≫ J6x81a Firmware Version < 001.2602a
   Hp ≫ J6x81a Version-
Hp ≫ J6x79a Firmware Version < 001.2602a
   Hp ≫ J6x79a Version-
Hp ≫ K7s38a Firmware Version < 001.2602a
   Hp ≫ K7s38a Version-
Hp ≫ T0g47a Firmware Version < 001.2602a
   Hp ≫ T0g47a Version-
Hp ≫ T0g48a Firmware Version < 001.2602a
   Hp ≫ T0g48a Version-
Hp ≫ T0g49a Firmware Version < 001.2602a
   Hp ≫ T0g49a Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.01% 0.002
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
hp-security-alert@hp.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-346 Origin Validation Error

The product does not properly verify that the source of data or communication is valid.