CVE-2024-47176
CVE-2024-47176 is a critical vulnerability in CUPS cups-browsed
that could allow unauthenticated remote command execution. Due to its insecure network handling, an attacker can manipulate printing attributes and potentially compromise the system. The CUPS vulnerability, CVE-2024-47176, arises from cups-browsed
binding to all network interfaces, trusting any incoming packet, and enabling manipulation of Get-Printer-Attributes
requests. While the CVSS score is 0, indicating a flaw in its calculation for this context, the SOCRadar Vulnerability Risk Score (SVRS) is 46, reflecting a moderate risk level, and there are existing exploits available. This means active exploitation is possible, and when combined with other vulnerabilities like CVE-2024-47076, CVE-2024-47175 and CVE-2024-47177, a malicious printer can execute arbitrary commands remotely without authentication. The vulnerability poses a significant security risk, especially in environments where network printing is prevalent, because attackers can potentially gain complete control of the affected systems. While the SVRS is below the critical threshold of 80, the existence of active exploits means immediate patching and mitigation strategies are warranted.
Description
CVE-2024-47176 is a critical vulnerability in CUPS, an open-source printing system. It allows an attacker to execute arbitrary commands remotely on the target machine without authentication when a print job is started. This vulnerability is particularly concerning as it can be exploited from the public internet, potentially exposing a vast number of systems to remote attacks if their CUPS services are enabled.
Key Insights
- The CVSS score of 8.3 indicates that this vulnerability is considered high risk.
- The SVRS score of 48 indicates that this vulnerability is considered critical and requires immediate action.
- Active exploits have been published to exploit this vulnerability.
- Threat actors, including
unknown
andshadow
, are actively using this vulnerability.
Mitigation Strategies
- Update CUPS to the latest version.
- Disable the CUPS service if it is not needed.
- Restrict access to the CUPS service to trusted hosts only.
- Monitor network traffic for suspicious activity.
Additional Information
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.