Security Digest · Vulnerability record
CVE-2024-47176: cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source
CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers.
CVSS 5.3 Medium EPSS 50.6% · p99 Check exposure
Should you act?
High exploit likelihood
EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
- EPSS 50.6%, percentile 99: FIRST’s model estimates a 50.6% chance of exploitation activity in the next 30 days, higher than 99% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Editorial verdict: Check exposure. CUPS cups-browsed RCE Chain: Real, but Needs a Print Job — Not the internet-ending bug the pre-disclosure hype suggested: code runs only when someone prints to the rogue printer, as the unprivileged lp user; but nothing should expose UDP 631 to the internet, and exposed hosts can be abused for DDoS.
What it is
CUPS is a standards-based, open-source printing system, and cups-browsed contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. cups-browsed binds to INADDRANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
Weakness type: CWE-1327.
Product: OpenPrinting cups-browsed · Assigned by: GitHub_M · Published: 2024-09-26
Affected and fixed versions
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| OpenPrinting | cups-browsed | <= 2.0.1 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: unchanged
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation poc, automatable no, technical impact partial.
- FIRST EPSS (model of 2026-10-21): 50.60% probability of exploitation activity in the next 30 days; percentile 99.
Timeline
- — CVE record published by GitHub_M
- — erroneo.us brief: CUPS cups-browsed RCE Chain: Real, but Needs a Print Job
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- CVE.org record CVE-2024-47176 cve.org
- NVD entry CVE-2024-47176 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- cups.org cups.org
- evilsocket.net evilsocket.net
- openwall.com openwall.com
- github.com github.com
- security.netapp.com security.netapp.com
- lists.debian.org lists.debian.org
- openwall.com openwall.com