CVE-2026-42626
CVE-2026-42626
Vexday Risk Score
33Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 5.9EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
22 May 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
HP ENVY 5000 series printers VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW printing). An unauthenticated remote attacker on the same network can establish a persistent connection to port 9100 and send keep-alive packets, causing the printer's session threads to remain locked in a waiting state. The firmware lacks connection timeouts and concurrent session limits, resulting in a persistent Denial of Service (DoS) that renders the printer unresponsive to all user commands and print jobs. Physical intervention (manual restart) is required to restore functionality, and the attack can be immediately re-initiated.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Affected products
n/a · n/apublic PoCs found — 1
cve_referencejacobmasse.medium.com/hp-envy-5000-printer-dos-vulnerability-8cae52c87b41unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.