CVE-2024-47176

MEDIUM EXPLOITED NUCLEI

OpenPrinting cups-browsed - Attacker-Controlled IPP Request Server-Side Request Forgery

Title source: manual
STIX 2.1

Exploitation Summary

CVE-2024-47176 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 19 public exploits from researchers including MalwareTech, l0n3m4n, mr-r3b00t, including a Metasploit module auxiliary/scanner/misc/cups_browsed_info_disclosure. A Nuclei detection template is also available.

AI-analyzed exploit summary This repository contains a scanner for CVE-2024-47176, a vulnerability in cups-browsed that allows unauthenticated remote discovery of vulnerable instances via UDP port 631. The scanner sends crafted UDP packets to trigger callbacks to an HTTP server, identifying vulnerable systems.

Description

CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.

Exploits (19)

nomisec SCANNER 66 stars
by MalwareTech · infoleak
https://github.com/MalwareTech/CVE-2024-47176-Scanner

This repository contains a scanner for CVE-2024-47176, a vulnerability in cups-browsed that allows unauthenticated remote discovery of vulnerable instances via UDP port 631. The scanner sends crafted UDP packets to trigger callbacks to an HTTP server, identifying vulnerable systems.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: CUPS (cups-browsed) versions affected by CVE-2024-47176
No auth needed
Prerequisites: Network access to UDP port 631 on target systems · Ability to host an HTTP server for callbacks
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 17 stars
by l0n3m4n · client-side
https://github.com/l0n3m4n/CVE-2024-47176

This PoC exploits CVE-2024-47176 by creating a malicious IPP printer service that injects a reverse shell command into the FoomaticRIPCommandLine attribute. It uses Zeroconf for service discovery and tricks targets into executing arbitrary commands when processing print jobs.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common Unix Printing System) with IPP support
No auth needed
Prerequisites: Network access to target · Target system must attempt to connect to the malicious printer service
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 9 stars
by mr-r3b00t · poc
https://github.com/mr-r3b00t/CVE-2024-47176

This repository contains a scanner for CVE-2024-47176, which targets IPP (Internet Printing Protocol) services. The scanner checks for open IPP ports and sends UDP packets to potential targets, logging HTTP responses.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common Unix Printing System) with cups-browserd daemon
No auth needed
Prerequisites: Network access to target CIDR range · Python environment with tqdm and requests libraries
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 7 stars
by lkarlslund · poc
https://github.com/lkarlslund/jugular

This repository contains a Go-based scanner for CVE-2024-47176, which exploits a vulnerability in CUPS (Common Unix Printing System) by sending UDP packets to trigger HTTP callbacks. It includes both a sender (`prod`) and a listener (`listen`) component to detect vulnerable CUPS instances.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common Unix Printing System)
No auth needed
Prerequisites: Network access to target CUPS instances · Ability to send UDP packets to port 631 · A reachable HTTP server to receive callbacks
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 7 stars
by GO0dspeed · poc
https://github.com/GO0dspeed/spill

This repository contains a Go-based scanner for detecting CVE-2024-47176, a vulnerability in OpenPrinting's IPP service over UDP port 631. It sends UDP packets to target IPs/CIDRs and listens for HTTP callbacks to identify vulnerable systems.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: OpenPrinting IPP service
No auth needed
Prerequisites: Network access to UDP port 631 · Ability to listen on a specified TCP port for callbacks
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 2 stars
by aytackalinci · infoleak
https://github.com/aytackalinci/CVE-2024-47176

This repository contains a Python script designed to scan multiple systems for the presence of CVE-2024-47176, a vulnerability in CUPS that allows remote code execution via crafted IPP requests. The script sends UDP packets to target IPs on port 631 and checks for responses indicative of the vulnerability.

Classification
Scanner 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Theoretical
Target: CUPS (Common Unix Printing System)
No auth needed
Prerequisites: List of target IPs · Network access to port 631 on target systems
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER 1 stars
by gianlu111 · infoleak
https://github.com/gianlu111/CUPS-CVE-2024-47176

This repository contains a multi-threaded scanner for CVE-2024-47176, which targets CUPS (Common Unix Printing System) via crafted UDP packets sent to port 631. The tool checks for vulnerable instances by sending payloads and logging responses via a callback server.

Classification
Scanner 90%
Attack Type
Other
Complexity
Moderate
Reliability
Theoretical
Target: CUPS (Common Unix Printing System)
No auth needed
Prerequisites: List of target IP addresses · Callback server for logging responses
devstral-2 · analyzed Feb 16, 2026 Full analysis →
github WORKING POC
by Rhyru9 · pythonpoc
https://github.com/Rhyru9/CUPS-CVE-2024-47176

This repository contains a functional exploit for CVE-2024-47176, targeting CUPS via a malicious IPP server and UDP trigger to achieve remote code execution. The exploit sets up a reverse shell listener and crafts a malicious PPD file to execute arbitrary commands on the target system.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common Unix Printing System)
No auth needed
Prerequisites: Attacker-controlled IP address · Target IP running CUPS · Network access to target's CUPS service
devstral-2 · analyzed May 29, 2026 Full analysis →
nomisec SCANNER
by jimi2x · infoleak
https://github.com/jimi2x/dirtycups

This repository contains a Python script that scans for CVE-2024-47176 by sending a UDP packet to the CUPS service and listening for a callback connection to determine vulnerability. It does not exploit the vulnerability but confirms its presence.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CUPS (Common Unix Printing System)
No auth needed
Prerequisites: network access to target CUPS service · UDP port 631 accessible
devstral-2 · analyzed May 12, 2026 Full analysis →
nomisec SUSPICIOUS
by deancooreman · poc
https://github.com/deancooreman/CVE-2024-47176

The repository claims to provide an automated VirtualBox lab environment for exploiting CVE-2024-47176 (unauthenticated RCE in CUPS) but lacks actual exploit code or technical details. The README is vague and does not include any functional PoC or analysis.

Classification
Suspicious 90%
Attack Type
Rce
Complexity
Theoretical
Reliability
Theoretical
Target: CUPS (unspecified version)
No auth needed
Prerequisites: VirtualBox · Kali Linux
devstral-2 · analyzed Mar 14, 2026 Full analysis →
gitlab SCANNER
by CSharpner · poc
https://gitlab.com/CSharpner/cups-cve-2024-47176-mitigation

This repository contains a bash script that checks for and mitigates the CUPS vulnerability (CVE-2024-47176) by disabling services and blocking port 631. It does not exploit the vulnerability but provides detection and mitigation steps.

Classification
Scanner 95%
Attack Type
Other
Complexity
Trivial
Reliability
Reliable
Target: CUPS and cups-browsed
Auth required
Prerequisites: sudo privileges · CUPS or cups-browsed running
devstral-2 · analyzed Feb 23, 2026 Full analysis →
nomisec SCANNER
by 0x7556 · poc
https://github.com/0x7556/CVE-2024-47176

This repository contains a scanner for CVE-2024-47176, which targets CUPS (Common UNIX Printing System) to detect vulnerable instances. The scanner checks for vulnerable CUPS versions by sending UDP packets and listening for responses.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CUPS (Common UNIX Printing System) versions affected by CVE-2024-47176
No auth needed
Prerequisites: Network access to target systems · CUPS service running and accessible
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by gumerzzzindo · client-side
https://github.com/gumerzzzindo/CVE-2024-47176

This repository contains a Python-based exploit for CVE-2024-47176, targeting CUPS (Common UNIX Printing System) via manipulated IPP requests to achieve remote command execution. The exploit leverages the cups-browsed functionality to send malicious print jobs, potentially leading to arbitrary command execution when combined with other vulnerabilities.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common UNIX Printing System)
No auth needed
Prerequisites: Access to target machine with port 631 exposed · Python installed on local machine · Required Python module (ippserver)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by nma-io · poc
https://github.com/nma-io/CVE-2024-47176

This Go script checks for CVE-2024-47176 by sending UDP packets to a target IP range and listening for HTTP callbacks from vulnerable CUPS servers. It identifies machines susceptible to the cups_browsed vulnerability.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: CUPS (cups_browsed)
No auth needed
Prerequisites: root/administrator privileges · network access to target IP range
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec SCANNER
by tonyarris · poc
https://github.com/tonyarris/CVE-2024-47176-Scanner

This repository contains a scanner for CVE-2024-47176, which targets a vulnerability in CUPS (Common UNIX Printing System). The script sends a UDP packet to port 631 to trigger an HTTP callback, indicating a vulnerable host.

Classification
Scanner 95%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CUPS (Common UNIX Printing System)
No auth needed
Prerequisites: List of target IPv4 addresses · Callback server to receive HTTP responses
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by workabhiwin09 · poc
https://github.com/workabhiwin09/CVE-2024-47176

This PoC exploits CVE-2024-47176 in the CUPS Browsd daemon, which allows remote attackers to add a printer via UDP broadcast, triggering a connection to an attacker-controlled HTTP server. The exploit demonstrates the vulnerability by sending a crafted UDP packet and logging the resulting HTTP request.

Classification
Working Poc 90%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: CUPS (Common Unix Printing System) Browsd daemon
No auth needed
Prerequisites: Network access to the target's UDP port 631 · CUPS Browsd daemon running and configured to allow remote connections
devstral-2 · analyzed Feb 16, 2026 Full analysis →
vulncheck_xdb WORKING POC
client-side
https://github.com/RickdeJager/cupshax

This repository contains a functional proof-of-concept exploit for CVE-2024-47176, leveraging DNS-SD (Bonjour) to advertise a malicious IPP printer service. The exploit injects a crafted PPD file via foomatic-rip to achieve remote code execution on vulnerable CUPS installations.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: CUPS (Common UNIX Printing System)
No auth needed
Prerequisites: Network access to the target (same subnet for DNS-SD discovery) · Target system must have CUPS installed and be vulnerable to PPD injection
devstral-2 · analyzed Feb 25, 2026 Full analysis →
metasploit SCANNER
by evilsocket, bcoles · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb

This Metasploit module scans for CUPS version and kernel information by hosting an HTTP server and analyzing User-Agent strings from incoming requests. It reports the gathered information but does not exploit a vulnerability for RCE or other offensive actions.

Classification
Scanner 90%
Attack Type
Info Leak
Complexity
Trivial
Reliability
Reliable
Target: CUPS (cups-browsed service)
No auth needed
Prerequisites: Network access to the target's CUPS service (port 631)
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
by Simone Margaritelli, Rick de Jager, s ipp-server, , # mDNS functionality, , · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb

This Metasploit module exploits multiple CUPS vulnerabilities (CVE-2024-47076, CVE-2024-47175, CVE-2024-47177, CVE-2024-47176) to achieve remote code execution via a malicious printer advertisement on the LAN. It uses mDNS and IPP protocols to trigger payload execution when a victim sends a print job.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: OpenPrinting CUPS (cups-browsed <= 2.0.1, libcupsfilters <= 2.1b1, libppd <= 2.1b1, cups-filters <= 2.0.1)
No auth needed
Prerequisites: LAN access · Victim interaction (sending a print job)
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

CUPS - Remote Code Execution
HIGHVERIFIEDby princechaddha
Shodan: product:cups

Scores

CVSS v3 5.3
EPSS 0.8759
EPSS Percentile 99.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

VulnCheck KEV 2024-09-27
CWE
CWE-1327
Status published
Products (1)
openprinting/cups-browsed 2.0.1
Published Sep 26, 2024
Tracked Since Feb 18, 2026