748 Printer Models Affected by Critical Flaw That Exposes Admin Passwords

Printers. We use them daily, often without a second thought. But lurking beneath the surface of these essential office and home devices is a significant security risk that’s been exposed by a recent study. Researchers at Rapid7 have unveiled a series of vulnerabilities affecting hundreds of printer models from major brands, including Brother, Fujifilm, Ricoh, Toshiba, and Konica Minolta. This poses a serious threat to your data and network security.

Default Passwords: The Open Door for Hackers

The most alarming vulnerability, identified as CVE-2024-51978, centers around the predictable nature of default administrator passwords on numerous Brother printer models. The problem? These passwords aren’t random or user-defined. Instead, they are generated automatically using the printer’s serial number and a specific algorithm – an algorithm that Rapid7 researchers have successfully deciphered.

Here’s a simplified breakdown of how it works:

1. Serial Number Snippet: The first 16 characters of the printer’s serial number are used.
2. Secret Sauce: A static string (think of it as a “salt” for password security) is added.
3. Hashing: The combined information undergoes a SHA256 hashing process.
4. Encoding: The result is encoded in Base64.
5. Final Extraction: The first 8 characters of the encoded output are extracted, with some character substitutions.

The implications are clear: if a hacker knows or can obtain your printer’s serial number, they can easily recreate the default password. The worst part? Many users never change the default password, leaving their printers vulnerable.

Expanding the Attack Surface: Beyond the Printer

This vulnerability acts as a springboard for more extensive attacks. Once an attacker gains access to the printer’s administrative interface using the default password, they can:

• Modify printer settings: This allows them to control how the printer operates.
• Intercept documents: They can potentially access scanned documents and print jobs.
• Access the address book: This could be used for phishing or other malicious activities.
• Exploit other vulnerabilities: Rapid7 identified several other weaknesses, including:
  • CVE-2024-51979: Enables a buffer overflow, potentially leading to remote code execution.
  • CVE-2024-51984: Allows attackers to steal credentials for external services, such as LDAP servers or FTP access.

In essence, a compromised printer connected to your network becomes a gateway to your entire system, a significant risk, especially in professional environments.

Extensive Impact: Hundreds of Printer Models at Risk

The Rapid7 study revealed a broad impact, with vulnerabilities affecting:

• Brother: 689 models
• Fujifilm: 46 models
• Konica Minolta: 6 models
• Ricoh: 5 models
• Toshiba: 2 models

A total of 748 printer models are affected by at least one of the eight identified security flaws. Some printers are vulnerable to multiple issues.

The most critical vulnerability (CVE-2024-51978), which relies on the predictable password generation algorithm, cannot be fixed via a simple firmware update. This is because the issue stems from the manufacturing process itself. Brother has updated its production process for future devices, but existing vulnerable models remain at risk unless users take action.

Protecting Your Printer: Practical Steps to Take

If you own a printer from any of the affected brands, immediate action is crucial. Here’s what you need to do:

1. Change the Administrator Password: This is the most critical step. Immediately change the default password, even in a home environment.
2. Update Firmware: Install the latest firmware updates provided by your printer manufacturer. These updates address many of the other discovered vulnerabilities.
3. Restrict Internet Access: Prevent unauthorized access to your printer’s administrative interface from outside your local network.
4. Network Segmentation: Implement firewall rules or use VLANs to control network access to the printer, especially in business settings.

For detailed instructions and a list of vulnerable models, consult your printer manufacturer’s security advisories. Here are direct links to the official pages:

• Brother
• Fujifilm
• Konica Minolta
• Ricoh
• Toshiba

Don’t delay! Protecting your printer is vital for maintaining the security of your network and your data. Taking action now can prevent significant problems down the road.

Source : Rapid7, Bleeping Computer