Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Plugin Spotlight: Samsung/Dell Printer Firmware SNMP Backdoor

Samsung Printers Contain an SNMP Backdoor

Samsung is not the most well-known printer manufacturer in the world (although they hold 28.5% of the consumer TV market). However, they manufacture a full line of printers and multi-function devices for both home and business use. Samsung also manufactures "some" printers for Dell, though an official list is currently unknown.

On November 28, 2012, US-CERT issued an advisory warning that select Samsung/Dell printers contained a hardcoded backdoor that could be accessed via SNMP. There are a lot of interesting facts surrounding this vulnerability, including:

  • The backdoor SNMP service listens on a non-standard UDP port 1118
  • The password for the backdoor is "[email protected]#n$p%c" and allows both SNMP reads and writes. This allows an attacker to change the configuration settings, including resetting the username/password to the device to gain full administrative access
  • Researchers report firmware dating back to 2004 contains this same password for the SNMP community string
  • If SNMP is disabled on the printer, it does not remove the SNMP backdoor on port 1118
  • Before the vulnerability went public, Samsung pulled all the printer firmware from their download sites
  • Dell printer firmware remains on Dell's website for download.

Samsung has stated that models released after October 31, 2012, are not affected by this vulnerability. However, a full list of vulnerable printer models and firmware revisions has yet to be published.

The Tenable plugin-writing team has pushed a new plugin into the Nessus feed, Samsung / Dell Printer SNMP Backdoor (plugin id 63136). This plugin allows you to scan your network for vulnerable Samsung/Dell printers, a handy tool since the vendor in this case is not specifying which devices and firmware contain the backdoor! Below is the plugin output:

Snmpbackdoor new small

Click above for larger image.

Note: You must configure your Nessus scan policy to scan printers. When creating the policy, be certain to go to "Preferences" -> "Do not scan fragile devices" and check the box labeled "Scan Network Printers."

This allows you to discover the vulnerable printers and multi-function devices on your network, even without a full list of vulnerable models from Samsung. To further enhance detection of this vulnerability, Passive Vulnerability Scanner (PVS) customers can utilize PVS plugin 6639, Samsung / Dell Printer SNMP Backdoor. Passively sniffing for this vulnerability allows you to detect vulnerable printers that may have slipped through the cracks of your active scanning (e.g., the printers were offline during the scan or blocked by a firewall).

Subscribe to the Tenable Blog

Subscribe
Try for Free Buy Now

Try Tenable.io

FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

$2,275

Buy Now

Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, email, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Learn More about Industrial Security

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.