Hundreds of Printers Expose Backend Panels and Password Reset Functions Online (bleepingcomputer.com)

Catalin Cimpanu, writing for BleepingComputer: A security researcher has found nearly 700 Brother printers left exposed online, allowing access to the password reset function to anyone who knows what to look for. Discovered by Ankit Anubhav, Principal Researcher at NewSky Security, the printers offer full access to their administration panel over the Internet. Anubhav has provided Bleeping Computer with a list of exposed printers. Accessing a few random URLs, Bleeping has discovered a wide range of Brother printer models, such as DCP-9020CDW, MFC-9340CDW, MFC-L2700DW, or MFC-J2510, just to name a few. The cause of all these exposures is Brother's choice of shipping the printers with no admin password. Most organizations most likely connected the printers to their networks without realizing the admin panel was present and wide open to connections. These printers are now easy discoverable via IoT search engines like Shodan or Censys.

Comments

Re:Connected Directly to the Internet?

[Anonymous Coward]

My former employer is a great example of publicly accessible printers. Multiple arguments (not disagreements... straight up arguments) with my manager at how absurd this was all so "a few people might need to print something from home and have it on their desk at work". No VPN. No locking down the printers to be only accessible from our subnet even. Plain ole HP 4250's exposed to the world with original firmware.

The best part was when 6 months after i gave up on arguing, we started getting printer spammed and all eyes were on me as though my mentioning it could happen automatically made me at fault.

"Hey what about ice bergs?"

This of course was the local university where everyone bends over backwards to anyone with a PHD because they always know better.

Best career move i could make was leaving the Titanic.edu!

Re:Connected Directly to the Internet?

[Tarlus]

I've come into numerous environments throughout my career that had a multitude of printers set up on public IP's, no firewall, and in numerous cases, with the default admin password. No valid reason for doing so. Just a lack of proper management.