Vulnerability in Hp D9l18a
CVE-2026-1997
Certain HP OfficeJet Pro printers may expose information if Cross‑Origin Resource Sharing (CORS) is misconfigured, potentially allowing unauthorized web origins to access device resource. CORS is disabled by default on Pro‑class devices and can only be enabled by an administrator through the Embedded Web Server (EWS). Keeping CORS disabled unless explicitly required helps ensure that only trusted solutions can interact with the device.
EPSS: 0.002 (9.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
Weakness classification (CWE)
References
- hp-security-alert@hp.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-1997?
- CVE-2026-1997 is a medium-severity vulnerability in Hp D9l18a, classified under Origin Validation Error. CVSS score: 5.3/10. Published 2026-02-10.
- How severe is CVE-2026-1997?
- Medium severity. CVSS v3 base score is 5.3 out of 10.