Vulnerabilities

An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker.

An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling.

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address.

An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631).

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device.