CVE-2024-47176mediumobserved exploitationCWE-1327

CVE-2024-47176: medium-severity vulnerability in OpenPrinting cups-browsed

cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source

Published · Updated

Follow this CVE+ Monitor cups-browsed+ Monitor cups-filters

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

82Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 5.3epss 51%
from disclosure to weaponsame day
Published on NVDSep 26
1st PoCSep 25
metasploitSep 26
VulnCheck+1d
In short

cups-browsed listens on all network interfaces (INADDR_ANY) on port 631 and accepts printer discovery packets from any source without verification. An attacker can send malicious printer information to trigger vulnerable code paths that, combined with other flaws, may lead to remote command execution.

Technical detail

cups-browsed binds to INADDR_ANY:631 and processes untrusted IPP (Internet Printing Protocol) packets without source validation, allowing an attacker on the network to send crafted Get-Printer-Attributes requests. This network exposure, combined with chaining vulnerabilities CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, enables remote code execution when a user interacts with a malicious printer advertisement.

Summary generated and translated by AI from the official description.
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
OpenPrinting · cups-browsed
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.