The font parsing issue isn’t the easiest to find or exploit, and anything requiring physical access poses logistical barriers for threat actors to overcome.” “However, these are not low-hanging fruits that would be obvious to many threat actors. Exploiting the font parser would only take a few seconds,” they warned. “A skilled attacker could successfully exploit the physical ports in a little over five minutes. Hirvonen and Bolshev believe that exploitation is difficult enough to prevent low-skilled actors from using them, whereas more experienced attackers could easily use them in targeted operations. In effect, this turns the printer into a beachhead on the network from where the attackers can spread out, establish persistence, and conduct deeper and more disruptive attacks up to data exfiltration and ransomware execution. Hirvonen and Bolshev said the most effective method of exploiting these vulnerabilities would be to trick a user at the target organisation into visiting a malicious website and exposing their MFP to a cross-site printing attack whereby the website automatically remotely prints a document containing a maliciously crafted font on the vulnerable device, given the attacker code execution rights.įrom there, the attacker can steal any data being run, or that has been cached, on the printer, including not only printed, scanned or faxed documents, but also passwords and login credentials used to connect the printer to the network.

“Experienced threat actors see unsecured devices as opportunities, so organisations that don’t prioritise securing their MFPs like other endpoints leave themselves exposed to attacks like the ones documented in our research.” And just like other endpoints, attackers can leverage a compromised device to damage an organisation’s infrastructure and operations,” said Hirvonen. “It’s easy to forget that modern MFPs are fully functional computers that threat actors can compromise just like other workstations and endpoints. If exploited successfully, F-Secure consultants Timo Hirvonen and Alexander Bolshev said they could be used to gain full control of a target enterprise’s network.

They are rated as being of high and critical severity respectively.

The vulnerabilities in question are tracked as CVE-2021-39237 and CVE-2021-39238, two access port vulnerabilities, which require physical access, and two font parsing vulnerabilities.

Timo hirvonen f secure