# Pre-Auth Remote Code Execution in Enterprise Network Printer Firmware via Fuzzed Management Protocol (STAR Labs Research)

> STAR Labs researchers built a QEMU-based AFL++ fuzzing harness against enterprise multifunction printer (MFP) firmware, driving crafted PJL, SNMP, and IPP protocol messages into exposed network listeners, and identified a stack buffer overflow caused by an unbounded length-prefixed field copied into a static buffer. They demonstrated unauthenticated remote code execution via ROP gadgetry, reproducing the crash-to-shell chain on physical hardware on the first attempt. No CVE or vendor/product name has been publicly disclosed; the authors state an advisory and CVE will follow.

- **Published:** 2026-07-19T00:00:00Z
- **Last reviewed:** 2026-07-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1542
- **ID:** TL-2026-1542
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2025-09-02, STAR Labs published a research writeup describing a fuzzing campaign against enterprise-grade network multifunction printers (MFPs). The researchers built a QEMU-based full-system emulation sandbox for the target firmware, hooked the network stack so that fuzzed inputs could reach the device's protocol parsers without physical hardware, and drove the American Fuzzy Lop plus plus (AFL++) fuzzer against three network-facing management protocol listeners simultaneously exposed by the device: Printer Job Language (PJL, historically carried on raw TCP/9100), Simple Network Management Protocol (SNMP), and Internet Printing Protocol (IPP, historically TCP/631). The fuzzer surfaced a crash in the handling of a length-prefixed field within one of these management protocols; the parser copied attacker-controlled data into a fixed-size stack buffer without validating that the declared length matched the buffer's capacity, producing a classic stack-based buffer overflow (CWE-121 / CWE-787 pattern) that can be triggered pre-authentication over the network.

The researchers characterized the target's exploit mitigation posture as: no stack canary/cookie protecting the overflowed frame ("classic stack smash, no cookie"), weak/brute-forceable ASLR reachable remotely, and NX (non-executable stack/heap) enforced. Because NX prevented direct shellcode injection but ASLR was weak enough to defeat over the network and no stack cookie blocked the overwrite, the team built a return-oriented programming (ROP) chain from gadgets present in the firmware image to pivot execution and open a shell through an existing admin-plane socket already present on the device — achieving remote code execution with no authentication and no user interaction. The team reports the resulting exploit chain reproduced successfully on physical target hardware on the first attempt after being validated in the QEMU emulation environment, indicating the emulated network/peripheral model was high-fidelity enough to carry the exploit primitives over from emulator to real device.

As of publication, STAR Labs has not disclosed the vendor, product line, model, or firmware version, and no CVE identifier has been assigned; the authors state that responsible disclosure to the affected vendor is in progress and that an advisory and CVE will follow. This threat record documents the vulnerability class, exploitation technique, and affected protocol surface as reported, and situates it against the broader, well-documented history of pre-auth RCE and memory-corruption vulnerabilities in enterprise MFP firmware exposed via PJL, SNMP, IPP, and raw-printing (port 9100) services from vendors including HP, Canon, Brother, Ricoh, Toshiba Tec, Konica Minolta, and Fujifilm Business Innovation — a product category with a long-running track record of unauthenticated, network-reachable memory-corruption bugs in these exact protocol parsers.

## MITRE ATT&CK

- T1595 Active Scanning
- T1587.004 Exploits
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1686 Disable or Modify System Firewall
- T1046 Network Service Discovery
- T1083 File and Directory Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1219 Remote Access Tools
- T1499 Endpoint Denial of Service
- T1529 System Shutdown/Reboot

## Sources

- [Fuzzing a Printer: Pre-auth RCE in a Network IoT Device](https://starlabs.sg/blog/2025/09-fuzzing-a-printer-pre-auth-rce-in-a-network-iot-device/)
- [CVE-2025-2146: Canon Satera MF656Cdw Buffer Overflow Flaw](https://www.sentinelone.com/vulnerability-database/cve-2025-2146/)
- [CVE-2025-26506 - Remote Code Execution & Elevation of Privilege in HP LaserJet Printers Explained](https://www.cve.news/cve-2025-26506/)
- [Multiple Brother Devices: Multiple Vulnerabilities (FIXED) - Rapid7 Blog](https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/)
- [Rooting a Printer: From Security Bulletin to Remote Code Execution - Tenable Blog](https://www.tenable.com/blog/rooting-a-printer-from-security-bulletin-to-remote-code-execution)
- [631 - Internet Printing Protocol (IPP) - HackTricks](https://hacktricks.wiki/en/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.html)
- [SoK: Exploiting Network Printers](https://www.ieee-security.org/TC/SP2017/papers/64.pdf)
- [AFL++: Combining Incremental Steps of Fuzzing Research](https://www.usenix.org/system/files/woot20-paper-fioraldi.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1542