Loading story…
Researchers disclosed a three-step exploit chain in the Brother MFC-J1010DW printer that can lead to unauthenticated remote code execution and full device compromise on firmware 1.18 and earlier. The chain starts with unauthenticated SNMP access that exposes the printer’s serial number, followed by a default administrator password derivation scheme based on that serial number, and an unauthenticated firmware rollback feature that allows the device to be downgraded to a vulnerable version.
After reversing the printer firmware, the researchers identified a stack-based buffer overflow in HTTP Referer header handling within the decode_csrftoken path and used it to achieve arbitrary code execution, demonstrating the attack by making the printer display "STAR LABS!" on its LCD. The report recommends upgrading to firmware 1.19 or later, disabling SNMP where it is not needed, changing default credentials, segmenting printers from other network assets, and strengthening vendor protections such as authenticated updates, rollback prevention, and safer coding practices.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
As a proof of concept, the researchers exploited the chain to achieve arbitrary code execution on the printer and display “STAR LABS!” on its LCD screen. The write-up also advised updating to firmware 1.19 or later and taking mitigations such as disabling unnecessary SNMP access and changing default credentials.
STAR Labs analyzed the Brother MFC-J1010DW and found a vulnerability chain affecting firmware 1.18 and earlier: unauthenticated SNMP access exposing the serial number, a default admin password derivation scheme based on that serial number, an unauthenticated firmware rollback mechanism, and a stack-based buffer overflow in HTTP Referer handling. Combined, these flaws allow unauthenticated remote code execution and full device compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
starlabs.sg
Open sourcestarlabs.sg
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Canon** disclosed patches for multiple **remote code execution** vulnerabilities affecting the *imageCLASS MF654Cdw* printer, following coordinated publication through **Zero Day Initiative** advisories tied to *Pwn2Own*. The flaws allow **network-adjacent, unauthenticated attackers** to execute arbitrary code in the context of the device, and each advisory assigns a **CVSS 8.8** severity rating. The vulnerabilities were reported in November 2025 and publicly released in March 2026, with Canon directing customers to its product security guidance for updates. The disclosed issues affect several distinct attack surfaces on the printer. **CVE-2025-14232** is a stack-based buffer overflow in **XPS** file parsing, **CVE-2025-14235** is an out-of-bounds write in **TrueType font** parsing, **CVE-2025-14234** is a heap-based buffer overflow triggered by a crafted font in a **PJCC** request within the **CADM** service listening on `TCP/9013`, and **CVE-2025-14236** is a stack-based buffer overflow in the `dtdc_addr_importSub` method. Together, the advisories indicate that malicious print content or protocol requests could be used to compromise exposed devices, reinforcing the need to patch internet-reachable and internally accessible printers promptly.
Jun 29, 2026
**CVE-2024-0244** is an unauthenticated heap-based buffer overflow in the Canon MF753Cdw's fax-job processing that can be triggered by sending a malformed binary fax job to the `/wsd/print` HTTP endpoint. The flaw copies an attacker-supplied destination fax-number length into the `phone_number` array without bounds checking, corrupting an adjacent object pointer that is subsequently passed to `free()`, yielding an arbitrary-free primitive. Researchers demonstrated remote code execution by chaining the flaw with Canon's unauthenticated BJNP protocol, which can place attacker-controlled data at predictable memory addresses. An attacker can place a fake heap chunk in a BJNP buffer, have it reused as a legitimate object, overwrite its function pointer, and redirect execution to shellcode stored in a second BJNP buffer; the device's dynamic memory is reported to be RWX. The Pwn2Own Toronto 2023 demonstration used the resulting code execution to retrieve and display an image on the printer screen.
Sep 23, 2026
Researchers disclosed a high-impact vulnerability chain in **OpenPrinting CUPS** affecting version `2.4.16` and earlier that can let an unauthenticated remote attacker progress from network-reachable print-job submission to **code execution as `lp`** and then to a **root-level file overwrite**. The chain combines `CVE-2026-34980`, which abuses anonymous `Print-Job` requests against a shared PostScript queue, with `CVE-2026-34990`, an authorization flaw that lets a local unprivileged user coerce `cupsd` into authenticating to an attacker-controlled localhost IPP service and reuse a print admin token to overwrite root-owned files. Public advisories and proof-of-concept details were released by researcher Asim Viladi Oglu Manizada and OpenPrinting, and fixes were committed publicly even though no patched release was yet available. Defenders were urged to reduce exposure immediately because exploitation depends on reachable `cupsd` services, legacy shared queues, and permissive submission behavior rather than user interaction. Recommended mitigations include disabling or restricting network exposure of CUPS, requiring authentication for shared queue submissions, disabling shared legacy queues where possible, and confining the service with **SELinux** or **AppArmor**. Follow-on discussion noted that removing CUPS outright may be impractical on some Ubuntu systems because `cupsd` is commonly installed by default and intertwined with other packages, making service isolation and firewalling more realistic short-term controls.
Jun 29, 2026