CVE-2023-26301

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
HP Inc.	HP LaserJet Pro	See HP Security Bulletin reference for affected versions.

References

https://support.hp.com/us-en/document/ish_8746769-8746795-16/hpsbpi03855Vendor Advisory
https://support.hp.com/us-en/document/ish_8746769-8746795-16/hpsbpi03855Vendor Advisory

Timeline

Published: Jul 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-263025.5Denial of service could be caused to the command line interface of markdown-it-py, before v2.2.0, if an attacker was allowed to use invalid CVE-2023-263035.5Denial of service could be caused to markdown-it-py, before v2.2.0, if an attacker was allowed to force null assertions with specially craft CVE-2023-263099.8A remote code execution vulnerability in the webview component of OnePlus Store app.CVE-2023-26314.3A missing permission check in Jenkins Code Dx Plugin 3.1.0 and earlier allows attackers with Overall/Read permission to connect to an attack CVE-2023-263109.8There is a command injection problem in the old version of the mobile phone backup app.CVE-2023-263119.8A remote code execution vulnerability in the webview component of OPPO Store app.CVE-2023-263148.8The mono package before 6.8.0.105+dfsg-3.3 for Debian allows arbitrary code execution because the application/x-ms-dos-executable MIME type CVE-2023-263158.8The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filter CVE-2023-263166.1A XSS vulnerability exists in the Xiaomi cloud service Application product. The vulnerability is caused by Webview's whitelist checking func CVE-2023-263179.8Xiaomi routers have an external interface that can lead to command injection. The vulnerability is caused by lax filtering of responses from CVE-2023-263187.2Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Xiaomi Xiaomi Router allows Overflow Buffers.CVE-2023-263197.2Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Xiaomi Xiaomi Router allows Command Inj