medium5.3
CVE-2026-1997
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origin…
Impact
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hp | M9l65a Firmware | before 001.2602a |
| Hp | D9l20a Firmware | before 001.2602b |
| Hp | K7s32a Firmware | before 001.2602b |
| Hp | D9l21a Firmware | before 001.2602b |
| Hp | K7s42a Firmware | before 001.2602b |
| Hp | T0g65a Firmware | before 001.2602b |
| Hp | K7s39a Firmware | before 001.2602b |
| Hp | J6x83a Firmware | before 001.2602b |
| Hp | K7s43a Firmware | before 001.2602b |
| Hp | K7s40a Firmware | before 001.2602b |
| Hp | K7s41a Firmware | before 001.2602b |
| Hp | T0g56a Firmware | before 001.2602b |