Certain HP Smart Tank All‑In‑One printers are vulnerable to a denial of service mechanism that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests. The weakness stems from improper handling of HTTP connections, identified as CWE‑400, and enables an attacker to exhaust resources or trigger a reallocation failure, resulting in loss of printing functionality for the duration of the outage.

Affected models include the HP Smart Tank 210, 215, 218, 5000, 5001, 5003, 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108, 5109, 5115, 520, 521, 523, 524, 525, 529, 580, 581, 582, 583, 584, 585, 588, 589, 591, 592, 593, 595, 596, 597, 598, 599. No specific firmware or revision details were disclosed, so all listed models may be affected.

The CVSS score of 6.9 categorizes the flaw as moderate severity. Since the EPSS score is unavailable, the exact likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. The probable attack vector is remote HTTP traffic, requiring no authentication or special privileges; an attacker who can reach the printer's web interface, either from the same local network or through an exposed interface, could trigger the issue by flooding it with concurrent requests. The resulting denial of service could disrupt business printing operations until the device is reset or the firmware is patched.