Samsung/Dell Printer firmware contains a backdoor administrator account

Malcontent · Nov 27, 2012

http://www.kb.cert.org/vuls/id/281284

Samsung printers (as well as some Dell printers manufactured by Samsung) contain a hardcoded SNMP full read-write community string that remains active even when SNMP is disabled in the printer management utility.

A remote, unauthenticated attacker could access an affected device with administrative privileges. Secondary impacts include: the ability to make changes to the device configuration, access to sensitive information (e.g., device and network information, credentials, and information passed to the printer), and the ability to leverage further attacks through arbitrary code execution.
Click to expand...

siljaline · Nov 28, 2012

US-CERT is warning of an administrator account in printers made by Samsung that allows an attacker to take full control of the devices. The account seems to be a hard-coded community string with full SNMP read and write access. This account remains active, even when SNMP is disabled in the printer's administration interface.
[...]
Besides Samsung-branded printers, some devices that the company produced for Dell also seem to be affected. However, the flaw seems to only affect models produced before 31 October 2012. According to US-CERT, Samsung plans to ship a patch tool to close the backdoor before the end of the year.
Click to expand...

Article

Cudni · Nov 28, 2012

Thanks. Also in
www.wilderssecurity.com/showthread.php?t=336785

Log in or Sign up

Samsung/Dell Printer firmware contains a backdoor administrator account

Malcontent Registered Member

siljaline Registered Member

Cudni Global Moderator

Log in or Sign up

Samsung/Dell Printer firmware contains a backdoor administrator account

Malcontent Registered Member

siljaline Registered Member

Cudni Global Moderator

Useful Searches