Loading story…
Researchers disclosed multiple vulnerabilities in the Italretail SpiceT Android-based fiscal printer that allowed unauthorized fiscal operations, including printing fake receipts, opening the cash drawer, and tampering with the device’s Electronic Journal (DGFE). The core issue was that Android applications could directly access the fiscal unit through the world-readable and writable device interface /dev/ttymxc4, while weak SELinux controls failed to isolate untrusted apps. Shielder reported that undocumented CUSTOM protocol commands could be abused to interleave fraudulent receipts with legitimate transactions and to delete, write, or overwrite files stored in the supposedly append-only DGFE memory.
A second part of the research described a remote exploit chain against the default ItalRetail RistorAndro point-of-sale application running on the printer. An unauthenticated web server on port 12312 exposed a /write endpoint vulnerable to path traversal and arbitrary file write, allowing attackers on the same LAN to place malicious APKs in the auto-update directory and trigger installation. Combined with Android 6 privilege-escalation flaws including CVE-2017-13156 and CVE-2016-5195, the chain could lead from remote code execution to system-level compromise and ultimately root, enabling full takeover of the fiscal printer and fraudulent fiscal record manipulation.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Shielder published the second part of its research describing a remote exploit chain against the SpiceT fiscal printer via the default RistorAndro POS application. The chain used an unauthenticated file-write flaw and Android privilege-escalation bugs to achieve remote takeover and potentially root access.
Shielder publicly disclosed the first part of its research on the SpiceT fiscal printer, detailing how installed Android apps could abuse access to the fiscal unit to print fake receipts, manipulate DGFE records, and perform other unauthorized operations.
Shielder reported multiple vulnerabilities in the Italretail SpiceT Android-based fiscal printer to Italretail in September 2020. The issues included unauthorized access to fiscal functions and the ability for apps to communicate directly with the fiscal unit.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
shielder.com
Open sourceshielder.com
Open sourcesecuritytxt.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a three-step exploit chain in the **Brother MFC-J1010DW** printer that can lead to unauthenticated remote code execution and full device compromise on firmware `1.18` and earlier. The chain starts with unauthenticated **SNMP** access that exposes the printer’s serial number, followed by a default administrator password derivation scheme based on that serial number, and an unauthenticated firmware rollback feature that allows the device to be downgraded to a vulnerable version. After reversing the printer firmware, the researchers identified a stack-based buffer overflow in HTTP `Referer` header handling within the `decode_csrftoken` path and used it to achieve arbitrary code execution, demonstrating the attack by making the printer display **"STAR LABS!"** on its LCD. The report recommends upgrading to firmware `1.19` or later, disabling SNMP where it is not needed, changing default credentials, segmenting printers from other network assets, and strengthening vendor protections such as authenticated updates, rollback prevention, and safer coding practices.
Jun 29, 2026
Security researchers have identified critical vulnerabilities in the Fiery Driver Updater, a software component embedded in print servers from major manufacturers such as Canon and Sharp. The flaws include hardcoded credentials and a lack of source file validation, which could allow attackers with prior access to exploit the updater for supply chain attacks and deliver malicious updates. These risks highlight the broader issue of printer infrastructure being an overlooked attack vector, with millions of devices potentially exposed due to poor update practices and weak security controls in printer management software. In a separate but related incident, a small business experienced a severe cyberattack after their cloud-connected smart receipt printer, running a discontinued version of Android Things, began malfunctioning and ultimately served as a gateway for malware. This case underscores the real-world impact of insecure printer devices and the dangers posed by outdated or poorly secured embedded operating systems in IoT hardware. Both findings emphasize the urgent need for organizations to treat printers and their associated software as critical components of their security posture.
Jun 29, 2026
Researchers published a technical analysis of **Ivanti Endpoint Manager Mobile (EPMM)** flaws `CVE-2025-4427` and `CVE-2025-4428`, describing a pre-authentication remote code execution path in the product and detailing how attacker-controlled input could reach vulnerable server-side processing. The disclosures focused on how exposed API functionality could be abused before authentication, raising concern for internet-facing EPMM deployments. A follow-on variant analysis identified a similar pre-auth RCE condition in the `/api/v2/policy/androidfirmware` endpoint, where unsanitized input in Hibernate Validator error-message templates could trigger **Expression Language injection** before Spring Security authorization checks. The write-up traced the issue through `AndroidFirmwarePolicyControllerV2`, `AndroidFirmwarePolicyRequest`, and related validation logic for the `deviceModel` field in Zebra firmware selections, and demonstrated evaluation with a proof of concept that returned `9999` from `${3*3333}`; the researchers later said the latest Ivanti version was not affected because of a Hibernate Validator upgrade.
Jul 24, 2026