Strix
26.1K

CVE-2026-1997

MEDIUMCVSS 6.9/10EPSS 0.20%

Last modified

CVE-2026-1997 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.

Description

Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0
6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
0.20%

9.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HpM9l65a Firmware< 001.2602a
HpD9l20a Firmware< 001.2602b
HpK7s32a Firmware< 001.2602b
HpD9l21a Firmware< 001.2602b
HpK7s42a Firmware< 001.2602b
HpT0g65a Firmware< 001.2602b
HpK7s39a Firmware< 001.2602b
HpJ6x83a Firmware< 001.2602b
HpK7s43a Firmware< 001.2602b
HpK7s40a Firmware< 001.2602b
HpK7s41a Firmware< 001.2602b
HpT0g56a Firmware< 001.2602b
HpD9l63a Firmware< 001.2602b
HpD9l64a Firmware< 001.2602b
HpJ3p65a Firmware< 001.2602b
HpJ3p66a Firmware< 001.2602b
HpJ3p67a Firmware< 001.2602b
HpJ3p68a Firmware< 001.2602b
HpT0g70a Firmware< 001.2602b
HpG5j38a Firmware< 001.2602a
HpT1p99a Firmware< 001.2602a
HpL3t99a Firmware< 001.2602a
HpY0s19a Firmware< 001.2602a
HpG5j56a Firmware< 001.2602a
HpY0s18a Firmware< 001.2602a
HpD9l18a Firmware< 001.2602a
HpM9l66a Firmware< 001.2602a
HpM9l67a Firmware< 001.2602a
HpT0g46a Firmware< 001.2602a
HpJ6x76a Firmware< 001.2602a
HpJ6x78a Firmware< 001.2602a
HpJ6x80a Firmware< 001.2602a
HpK7s37a Firmware< 001.2602a
HpM9l70a Firmware< 001.2602a
HpJ6x77a Firmware< 001.2602a
HpJ6x81a Firmware< 001.2602a
HpJ6x79a Firmware< 001.2602a
HpK7s38a Firmware< 001.2602a
HpT0g47a Firmware< 001.2602a
HpT0g48a Firmware< 001.2602a
HpT0g49a Firmware< 001.2602a

References

Timeline

Published
Last Modified
Status
Analyzed

Frequently Asked Questions

What is CVE-2026-1997?
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
How severe is CVE-2026-1997?
CVE-2026-1997 has a CVSS score of 6.9/10 (MEDIUM severity). The EPSS model estimates a 0.20% probability of exploitation in the next 30 days.
How do I fix CVE-2026-1997?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-1997?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST