Pre-Auth Remote Code Execution in Enterprise Network Printer Firmware via Fuzzed Management Protocol (STAR Labs Research)

Pre-Auth Remote Code Execution in Enterprise Network Printer (TL-2026-1542) is a high-severity software vulnerability, first published 2026-07-19. It has no confirmed attribution, affects Undisclosed (pending STAR Labs vendor disclosure and CVE assignment), maps to 16 MITRE ATT&CK techniques (T1005, T1046, T1059), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1542

Threat ID
TL-2026-1542
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
government administration, finance, health, manufacturing, education, legal, retail, technology
Target regions
Global
Detection rules
9
Indicators of compromise
15

Malware and tooling in Pre-Auth Remote Code Execution in Enterprise Network Printer

Malware and tooling: AFL++, QEMU

STAR Labs researchers built a QEMU-based AFL++ fuzzing harness against enterprise multifunction printer (MFP) firmware, driving crafted PJL, SNMP, and IPP protocol messages into exposed network listeners, and identified a stack buffer overflow caused by an unbounded length-prefixed field copied into a static buffer. They demonstrated unauthenticated remote code execution via ROP gadgetry, reproducing the crash-to-shell chain on physical hardware on the first attempt. No CVE or vendor/product name has been publicly disclosed; the authors state an advisory and CVE will follow.

How Pre-Auth Remote Code Execution in Enterprise Network Printer works

On 2025-09-02, STAR Labs published a research writeup describing a fuzzing campaign against enterprise-grade network multifunction printers (MFPs). The researchers built a QEMU-based full-system emulation sandbox for the target firmware, hooked the network stack so that fuzzed inputs could reach the device's protocol parsers without physical hardware, and drove the American Fuzzy Lop plus plus (AFL++) fuzzer against three network-facing management protocol listeners simultaneously exposed by the device: Printer Job Language (PJL, historically carried on raw TCP/9100), Simple Network Management Protocol (SNMP), and Internet Printing Protocol (IPP, historically TCP/631). The fuzzer surfaced a crash in the handling of a length-prefixed field within one of these management protocols; the parser copied attacker-controlled data into a fixed-size stack buffer without validating that the declared length matched the buffer's capacity, producing a classic stack-based buffer overflow (CWE-121 / CWE-787 pattern) that can be triggered pre-authentication over the network.

The researchers characterized the target's exploit mitigation posture as: no stack canary/cookie protecting the overflowed frame ("classic stack smash, no cookie"), weak/brute-forceable ASLR reachable remotely, and NX (non-executable stack/heap) enforced. Because NX prevented direct shellcode injection but ASLR was weak enough to defeat over the network and no stack cookie blocked the overwrite, the team built a return-oriented programming (ROP) chain from gadgets present in the firmware image to pivot execution and open a shell through an existing admin-plane socket already present on the device — achieving remote code execution with no authentication and no user interaction. The team reports the resulting exploit chain reproduced successfully on physical target hardware on the first attempt after being validated in the QEMU emulation environment, indicating the emulated network/peripheral model was high-fidelity enough to carry the exploit primitives over from emulator to real device.

As of publication, STAR Labs has not disclosed the vendor, product line, model, or firmware version, and no CVE identifier has been assigned; the authors state that responsible disclosure to the affected vendor is in progress and that an advisory and CVE will follow. This threat record documents the vulnerability class, exploitation technique, and affected protocol surface as reported, and situates it against the broader, well-documented history of pre-auth RCE and memory-corruption vulnerabilities in enterprise MFP firmware exposed via PJL, SNMP, IPP, and raw-printing (port 9100) services from vendors including HP, Canon, Brother, Ricoh, Toshiba Tec, Konica Minolta, and Fujifilm Business Innovation — a product category with a long-running track record of unauthenticated, network-reachable memory-corruption bugs in these exact protocol parsers.

MITRE ATT&CK techniques used in TL-2026-1542

Collection

T1005 Data from Local System

Discovery

T1046 Network Service Discovery; T1083 File and Directory Discovery

Execution

T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services

Defense Evasion

T1211 Exploitation for Stealth

Command and Control

T1219 Remote Access Tools

Impact

T1499 Endpoint Denial of Service; T1529 System Shutdown/Reboot

Persistence

T1547 Boot or Logon Autostart Execution

Resource Development

T1587.004 Exploits

Reconnaissance

T1595 Active Scanning

defense-impairment

T1686 Disable or Modify System Firewall

Affected products and versions in Pre-Auth Remote Code Execution in Enterprise Network Printer

  • Undisclosed (pending STAR Labs vendor disclosure and CVE assignment) — Enterprise network multifunction printer (MFP) firmware
    Vulnerable versions: undisclosed

Remediation for Pre-Auth Remote Code Execution in Enterprise Network Printer

Patches

  • No vendor patch is currently available — vendor and product are undisclosed and no CVE has been assigned as of the source publication (2025-09-02); monitor STAR Labs and affected-vendor PSIRT channels for the forthcoming advisory

Immediate actions

  • Restrict network exposure of printer/MFP management interfaces (PJL, SNMP, IPP, raw port 9100/515/631) to trusted management VLANs only; do not expose MFP management protocols directly to general user networks or the internet
  • Place all network printers and MFPs behind firewall ACLs that block inbound connections to TCP/9100, TCP/631, TCP/515, and SNMP (UDP/161) from untrusted subnets
  • Disable unused management protocols (PJL raw port, SNMP, IPP) on devices where they are not operationally required, per vendor hardening guidance
  • Change default/manufacturer-derived SNMP community strings and disable SNMPv1/v2c in favor of SNMPv3 with authentication/encryption where supported

Workarounds

  • Network-layer isolation and ACL restriction of PJL/SNMP/IPP/raw-print listeners is the only available mitigation until vendor disclosure
  • Where feasible, disable remote/network administration features on MFPs and require physical console or authenticated VPN access for management functions

Longer-term hardening

  • Maintain a firmware inventory and patch cadence for all networked print/MFP fleets; subscribe to vendor PSIRT advisories (HP, Canon, Brother, Ricoh, Konica Minolta, Toshiba Tec, Fujifilm Business Innovation) since STAR Labs has stated the affected vendor advisory and CVE are forthcoming
  • Deploy network segmentation isolating IoT/embedded print devices from general corporate and server VLANs, consistent with historical printer-as-pivot research (e.g. Tenable HP PageWide/OfficeJet root-shell research)
  • Require print/MFP management traffic to traverse an authenticated management plane (e.g. jump host, VPN) rather than being reachable from arbitrary endpoints
  • Enable and monitor exploit-mitigation features (ASLR, stack canaries, NX/DEP) in vendor firmware where configurable, and prioritize vendors/models demonstrating standard mitigations in independent research

Weaknesses (CWE) in Pre-Auth Remote Code Execution in Enterprise Network Printer

CWE-121, CWE-787, CWE-20

Timeline of Pre-Auth Remote Code Execution in Enterprise Network Printer

  • Tenable published research ('Rooting a Printer') demonstrating PJL path-traversal (CVE-2017-2741) leading to root shell on HP PageWide/OfficeJet Pro printers via FSUPLOAD/FSDOWNLOAD directory traversal and SNMP-triggered reboot, establishing the historical precedent for pre-auth RCE via printer management protocols.
  • Rapid7 initiated coordinated disclosure to Brother and OEM partners (FUJIFILM Business Innovation, Ricoh, Toshiba Tec, Konica Minolta) after discovering 8 vulnerabilities including a stack buffer overflow (CVE-2024-51979) and critical auth bypass (CVE-2024-51978) across 748 printer models exposing PJL/SNMP/IPP/HTTP services.
  • HP published advisory for CVE-2025-26506, a PostScript-interpreter RCE/privilege-escalation vulnerability in HP LaserJet Pro/Enterprise/Managed printers triggered by a crafted print job, illustrating the same unauthenticated network-print-job attack surface.
  • CVE-2025-2146 (Canon Satera/imageCLASS WebService Authentication buffer overflow, CVSS 9.8) published to NVD, reinforcing that critical unauthenticated printer memory-corruption vulnerabilities are an active, ongoing disclosure trend contemporaneous with the STAR Labs research.
  • Rapid7/Brother public disclosure date for the 8-vulnerability chain (CVE-2024-51977 through CVE-2024-51984) affecting 748 MFP models across 5 vendors, confirming PJL and SNMP as recurring unauthenticated attack vectors in this device class.
  • STAR Labs states responsible disclosure to the affected (undisclosed) vendor is in progress, with a formal advisory and CVE assignment to follow; vendor, product, and firmware version remain withheld pending that process.
  • STAR Labs publishes 'Fuzzing a Printer: Pre-auth RCE in a Network IoT Device,' describing the QEMU/AFL++ fuzzing campaign against an undisclosed enterprise MFP's PJL/SNMP/IPP listeners, the discovered stack buffer overflow in a length-prefixed field, and a working unauthenticated ROP-based RCE chain reproduced on physical hardware.
  • Canon discloses CVE-2025-14237, a buffer overflow in XPS font parsing on Canon Small Office MFPs/laser printers, allowing local-network unauthenticated crash or RCE — a further contemporaneous example of the printer memory-corruption vulnerability class this threat belongs to.
  • TL-Intel-Harness ingests the STAR Labs research writeup via RSS hunt and opens threat record TL-2026-1542 pending vendor advisory/CVE assignment.

Sources cited for Pre-Auth Remote Code Execution in Enterprise Network Printer

Threats related to Pre-Auth Remote Code Execution in Enterprise Network Printer

Detection coverage for TL-2026-1542

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1542 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats