CVE-2024-47176
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 50.6%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 50.60% probability · 99th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-1327
- Affected
- openprinting/cups-browsed
- Source
- security-advisories@github.com
EPSS 50.6% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992Product
- https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8Exploit, Vendor Advisory
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47Not Applicable
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5Not Applicable
- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6Not Applicable
- https://www.cups.orgProduct
- https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-IExploit, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2024/09/27/6Mailing List
- http://www.openwall.com/lists/oss-security/2025/09/11/2
- https://github.com/OpenPrinting/cups-browsed/commit/1debe6b140c37e0aa928559add4abcc95ce54aa2Patch
- https://lists.debian.org/debian-lts-announce/2024/09/msg00048.html
- https://security.netapp.com/advisory/ntap-20241011-0001/
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.