---
title: "CUPS cups-browsed RCE Chain: Real, but Needs a Print Job"
url: https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/
description: "cups-browsed on UDP 631 lets attackers add a rogue printer that runs commands when printed to. Disable cups-browsed or block UDP 631; most servers can relax."
type: security-brief
section: "Security Digest"
date_published: 2024-09-26
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-47176", "CVE-2024-47076", "CVE-2024-47175", "CVE-2024-47850"]
severity: "high"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# CUPS cups-browsed RCE Chain: Real, but Needs a Print Job

**Verdict: Check exposure.** Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS.

- **Who must act:** Linux and Unix desktops, laptops and print servers running cups-browsed with UDP 631 reachable from untrusted networks, and anyone whose hosts answer UDP 631 on the internet.
- **Who can relax:** Servers and containers without cups-browsed installed or running, and hosts that firewall UDP 631 and have applied distribution updates.
- **Affected:** cups-browsed 2.0.1 and earlier; libcupsfilters 2.1b1 and earlier; libppd 2.1b1 and earlier; cups-browsed before 2.5b1 (CVE-2024-47850 DDoS)
- **Fixed:** Distribution security updates (e.g., Red Hat RHSA-2024:7346, RHSA-2024:7463, RHSA-2024:7553); Configuration fix: BrowseRemoteProtocols none, or cups-browsed disabled
- **CVEs:** CVE-2024-47176, CVE-2024-47076, CVE-2024-47175, CVE-2024-47850
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. Check whether cups-browsed runs: systemctl status cups-browsed
2. If you do not need network printer discovery, stop and disable it: sudo systemctl disable --now cups-browsed
3. If you need it, set BrowseRemoteProtocols none (or remove 'cups') in /etc/cups/cups-browsed.conf and restart
4. Block inbound UDP 631 at host and perimeter firewalls
5. Install your distribution's CUPS-related security updates

### How to check if you are affected

- Run sudo ss -lunp | grep 631 to see if anything listens on UDP 631
- Check lpstat -v and the CUPS web UI for printers you did not add
- Look in /etc/cups/ppd/ for PPD files containing FoomaticRIPCommandLine or cupsFilter2 lines pointing at foomatic-rip with shell commands
- Review logs for unexpected processes spawned by the lp user

## What happened

On September 26, 2024, researcher Simone Margaritelli published [an unauthenticated remote code execution chain](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I) in the OpenPrinting CUPS stack used by most Linux distributions. The disclosure was preceded by days of speculation about a "9.9" Linux bug, a score he says was an early estimate he would not have chosen himself.

The chain, per the [CVE records](https://www.cve.org/CVERecord?id=CVE-2024-47176) and OpenPrinting advisories:

- **CVE-2024-47176** (cups-browsed <= 2.0.1): the daemon binds to UDP 631 on all interfaces and trusts any packet, so one datagram makes it fetch printer attributes from an attacker URL.
- **CVE-2024-47076** (libcupsfilters): returned IPP attributes are not sanitized.
- **CVE-2024-47175** (libppd): those attributes are written unsanitized into a generated PPD file.
- An injected `foomatic-rip` filter line then runs attacker commands when a job is printed. This last link was filed as CVE-2024-47177, which was [rejected in May 2025 as a duplicate](https://www.cve.org/CVERecord?id=CVE-2024-47177) of the other three.

Scores vary widely: 5.3 for CVE-2024-47176, 8.6 from GitHub for the library bugs, and 9.8 from [NVD for CVE-2024-47175](https://nvd.nist.gov/vuln/detail/CVE-2024-47175).

## Who is affected

Systems running `cups-browsed` with UDP 631 reachable: many Linux desktop installs, some BSDs, and others the researcher listed. Margaritelli reported callbacks from hundreds of thousands of internet hosts during weeks of scanning. Red Hat's [RHSB-2024-002](https://access.redhat.com/security/vulnerabilities/RHSB-2024-002) rated it Important and said the shipped configuration is vulnerable but the service is disabled by default on RHEL. Typical cloud servers and containers do not run cups-browsed.

## Do you really need to act?

Mostly no, with two real caveats. The hype did not match the preconditions. A packet alone only plants a rogue printer; code runs when a user or system prints to it, and it runs as the unprivileged `lp` user, per Red Hat. There is no confirmed in-the-wild exploitation, and none of these CVEs are in CISA KEV as of October 21, 2026. A LAN attacker can reach the same path via mDNS/DNS-SD spoofing, which matters more for laptops on shared Wi-Fi.

The caveats. First, the researcher notes the rogue printer is added silently, with no user notification, so "the user must print" is weaker than it sounds on a desktop. Second, [Akamai showed](https://www.akamai.com/blog/security-research/october-cups-ddos-threat) that the same single-packet behavior turns exposed hosts into DDoS reflectors: of more than 198,000 responding devices, over 58,000 were abusable, with about 600x average amplification and a few hundred looping endlessly. That is tracked as [CVE-2024-47850](https://www.cve.org/CVERecord?id=CVE-2024-47850) (cups-browsed before 2.5b1). If your hosts answer UDP 631 on the internet, you are someone else's attack infrastructure.

## What to do now

1. Check: `systemctl status cups-browsed` and `sudo ss -lunp | grep 631`.
2. Not printing to network-discovered printers? `sudo systemctl disable --now cups-browsed`, or remove the package.
3. Need it? Set `BrowseRemoteProtocols none` in `/etc/cups/cups-browsed.conf` and restart, as the [OpenPrinting advisory](https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8) and Red Hat recommend. A value including `cups` is vulnerable.
4. Block inbound UDP 631 at host and perimeter firewalls.
5. Apply distribution updates for cups-browsed, libcupsfilters, libppd and cups-filters.

## How to tell if you were hit

List printers with `lpstat -v` and remove any you do not recognize. Inspect PPD files under `/etc/cups/ppd/` for `FoomaticRIPCommandLine` or filter lines invoking `foomatic-rip` with shell commands. Review logs for unexpected processes run by the `lp` user. For DDoS abuse, Akamai suggests watching for HTTP POSTs to `/printers/` or `/classes/` with a `CUPS/` User-Agent and `application/ipp` content type.

## Timeline

- Sep 5, 2024 — Researcher reports issues to OpenPrinting.
- Sep 26, 2024 — Public disclosure, CVEs and advisories published.
- Oct 1, 2024 — Akamai publishes DDoS amplification research.
- May 12, 2025 — CVE-2024-47177 rejected as a duplicate.

## Sources

1. [OpenPrinting — cups-browsed advisory GHSA-rj88-6mr5-rcw8](https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8)
2. [CVE.org — CVE-2024-47176 record](https://www.cve.org/CVERecord?id=CVE-2024-47176)
3. [NVD — CVE-2024-47175](https://nvd.nist.gov/vuln/detail/CVE-2024-47175)
4. [CVE.org — CVE-2024-47177 (rejected as duplicate)](https://www.cve.org/CVERecord?id=CVE-2024-47177)
5. [Simone Margaritelli (evilsocket) — Attacking UNIX Systems via CUPS, Part I](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I)
6. [Red Hat — RHSB-2024-002 OpenPrinting cups-filters](https://access.redhat.com/security/vulnerabilities/RHSB-2024-002)
7. [Akamai Security Research — CUPS DDoS threat (October 2024)](https://www.akamai.com/blog/security-research/october-cups-ddos-threat)
8. [CVE.org — CVE-2024-47850 record](https://www.cve.org/CVERecord?id=CVE-2024-47850)

---
Source page: https://erroneo.us/security/briefs/cups-browsed-rce-chain-cve-2024-47176/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt