Loading story…
Security researchers have identified critical vulnerabilities in the Fiery Driver Updater, a software component embedded in print servers from major manufacturers such as Canon and Sharp. The flaws include hardcoded credentials and a lack of source file validation, which could allow attackers with prior access to exploit the updater for supply chain attacks and deliver malicious updates. These risks highlight the broader issue of printer infrastructure being an overlooked attack vector, with millions of devices potentially exposed due to poor update practices and weak security controls in printer management software.
In a separate but related incident, a small business experienced a severe cyberattack after their cloud-connected smart receipt printer, running a discontinued version of Android Things, began malfunctioning and ultimately served as a gateway for malware. This case underscores the real-world impact of insecure printer devices and the dangers posed by outdated or poorly secured embedded operating systems in IoT hardware. Both findings emphasize the urgent need for organizations to treat printers and their associated software as critical components of their security posture.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
BankInfoSecurity reported vulnerabilities in printer driver updater mechanisms that could allow poisoned or malicious updates to be delivered. The reference indicates public disclosure of the flaws but provides no additional earlier event dates in the provided content.
An OSINT Team Blog report described a case in which a low-cost smart printer was implicated in a security incident that severely affected a local business. The available reference provides no further dated incident details beyond the article publication.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in Apache Tomcat, identified as CVE-2025-48989, allows remote, unauthenticated attackers to degrade HTTP/2 service performance, potentially leading to a denial-of-service (DoS) condition. The flaw, caused by improper resource shutdown or release, affects Tomcat versions 11.0.0-M1 through 11.0.9, 10.1.0-M1 through 10.1.43, and 9.0.0.M1 through 9.0.107, with patches available in subsequent releases. F5 has confirmed that while some of its products use vulnerable Tomcat versions, not all are affected due to lack of HTTP/2 support. Organizations are advised to upgrade to the fixed versions to mitigate risk. Separately, a use-after-free vulnerability in CUPS (CVE-2023-34241) impacts versions from 2.0.0 up to but not including 2.4.6, potentially allowing attackers to corrupt data, cause DoS, or execute unauthorized code. The issue arises from improper memory handling during logging operations after a connection is closed. Additionally, research has highlighted a severe vulnerability (CVE-2024-12649, CVSS 9.8) in Canon printers, where attackers can execute malicious code simply by sending a specially crafted XPS file containing a malicious TrueType Font (TTF). These vulnerabilities underscore the increasing focus of attackers on networked devices like printers and print services, which often lack robust endpoint protection and can serve as entry points into organizational networks.
Jun 29, 2026
Multiple vulnerabilities in the Common Unix Printing System (**CUPS**) were publicly disclosed, including flaws that can be chained into **remote code execution** on affected Linux and Unix systems. Reporting described the issue as a critical CUPS-based RCE risk, while an `oss-security` disclosure listed multiple **CVEs** tied to the print server and related components, expanding the scope from a single bug to a broader set of weaknesses in widely deployed printing infrastructure. Subsequent coverage said AI agents were able to identify vulnerabilities in the same Linux and Unix print server stack, underscoring how quickly offensive research techniques can surface exploitable flaws in foundational services. Because CUPS is commonly enabled across enterprise and workstation environments, the disclosures raised concern that exposed or reachable print services could provide attackers with a path to execute code remotely, making patching, service exposure review, and printer-related attack surface reduction urgent priorities.
Jul 12, 2026
Researchers disclosed a three-step exploit chain in the **Brother MFC-J1010DW** printer that can lead to unauthenticated remote code execution and full device compromise on firmware `1.18` and earlier. The chain starts with unauthenticated **SNMP** access that exposes the printer’s serial number, followed by a default administrator password derivation scheme based on that serial number, and an unauthenticated firmware rollback feature that allows the device to be downgraded to a vulnerable version. After reversing the printer firmware, the researchers identified a stack-based buffer overflow in HTTP `Referer` header handling within the `decode_csrftoken` path and used it to achieve arbitrary code execution, demonstrating the attack by making the printer display **"STAR LABS!"** on its LCD. The report recommends upgrading to firmware `1.19` or later, disabling SNMP where it is not needed, changing default credentials, segmenting printers from other network assets, and strengthening vendor protections such as authenticated updates, rollback prevention, and safer coding practices.
Jun 29, 2026