Printer Hax & Wildcard Tunneling – Hak5 ’25×01

The video discusses a new vulnerability that was revealed in the Common Unix Printing System (CUPS), particularly affecting network printers on Linux systems. Alex Lyn joins Darren Kitchen to explore this remote code execution (RCE) exploit and demonstrate some of its implications, including how malicious printers can potentially compromise systems on the same network.

**Keypoints:**

Discussion on a new CUPS vulnerability that allows for remote code execution (RCE) on Linux systems.

The Common Unix Printing System (CUPS) has been around since the 90s and is maintained by Apple.

Attackers can exploit CUPS if they are on the same network as vulnerable printers.

CUPS listens on Port 631 for both TCP (for managing print jobs) and UDP (for printer discovery).

Malicious printers can advertise themselves to networked devices, leading to exploitation.

Demonstration of how command injection can occur due to improper input sanitation within the printer attribute files.

Discussion of specific commands and tools like Python scripts used to demonstrate the exploit.

Advice to update CUPS and avoid exposing UDP Port 631 to the internet to mitigate risks.

Examples of various devices, including unexpected ones, that may have CUPS enabled, increasing vulnerability.

Cautionary notes on potential risks in public spaces, like co-working environments, regarding duplicated printer names and social engineering attacks.