Certain HP OfficeJet Pro printers may expose sensitive device data if Cross‑Origin Resource Sharing (CORS) is incorrectly enabled. The flaw allows a malicious web origin to send cross‑domain requests to the embedded web server and retrieve resources or configuration information that should be protected. The weakness is identified as CWE‑346 (Information Exposure Through an Error).

Affected devices include the HP OfficeJet Pro 7720 Wide Format All‑in‑One Printer series, HP OfficeJet Pro 7730 Wide Format All‑in‑One Printer, HP OfficeJet Pro 7740 Wide Format All‑in‑One Printer series, HP OfficeJet Pro 8210 Printer series, HP OfficeJet Pro 8710 All‑in‑One Printer series, HP OfficeJet Pro 8730 All‑in‑One Printer, HP OfficeJet Pro 8730 Mono Printer series, and HP OfficeJet Pro 8740 All‑in‑One Printer series. The vulnerability arises in the embedded web server firmware across multiple hardware revisions listed in the CPE set.

The CVSS v3.1 score is 6.9, indicating a moderate impact. EPSS is below 1 %, implying a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to trick a user with a malicious web page or have some remote code capable of sending cross‑origin requests to the printer’s web interface; no local privileges are required. Because CORS is disabled by default and must be enabled by an administrator, the likelihood of this condition existing is low, but once enabled it allows an unauthorized origin to read device data.