--- title: Unauthenticated RCE on all GNU/Linux system – Should you be concerned? description: On September 26th an Italian security researcher released details regarding an unauthenticated remote command execution (RCE) vulnerability affecting all GNU/Linux systems – Simone Margaritelli, known as evilsocket is a veteran of the infosec community, and you might probably know him as the father of Bettercap and Pwnagotchi projects (among others). image: https://csacyber.com/hubfs/1727384720922.png --- [Skip to content](https://csacyber.com/blog/unauthenticated-rce-on-all-gnu/linux-system-should-you-be-concerned#main-content) [![CSA Cyber - Cyber Security Solutions to Protect your People](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=300&height=108&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber - Cyber Security Solutions to Protect your People")](https://csacyber.com/) - Services - [Offensive Security Services](https://csacyber.com/offensive-security-services) - [Penetration Testing](https://csacyber.com/penetration-testing) - [Red Teaming and attack simulations](https://csacyber.com/offensive-security-services#red-teaming) - [Continuous testing](https://csacyber.com/offensive-security-services#continuous-assurance) - [Managed offensive security](https://csacyber.com/offensive-security-services#managed-offensive) - [Consultancy Services](https://csacyber.com/cyber-consultancy-services) - [Frameworks & assessments](https://csacyber.com/cyber-consultancy-services/frameworks-and-assessments) - [Data protection](https://csacyber.com/cyber-consultancy-services#data-protection) - [Virtual leadership](https://csacyber.com/cyber-consultancy-services#virtual-leadership) - [Technical security consulting](https://csacyber.com/cyber-consultancy-services#technical-consultancy) - [Governance, Risk & Compliance (GRC)](https://csacyber.com/cyber-consultancy-services/governance-risk-and-compliance-services) - [Extended Managed Security Services](https://csacyber.com/extended-managed-security-services) - [Microsoft Sentinel SIEM](https://csacyber.com/extended-managed-security-services#microsoft-sentinel) - [SOC services](https://csacyber.com/extended-managed-security-services#soc-services) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/extended-managed-security-services#cyber-helpdesk) - [Incident Response Services](https://csacyber.com/incident-response-services) - [Emergency Incident Response](https://csacyber.com/urgent/emergency-incident-response) - [Incident Response Retainer](https://csacyber.com/incident-response-services) - [Cyber Incident Readiness & Response Planning](https://csacyber.com/incident-response-services) - [Tabletop Exercises & Live-Range Engagements](https://csacyber.com/incident-response-services) - [Specialist Security Services](https://csacyber.com/specialist-services) - [AI Security](https://csacyber.com/cyber-services-for-ai) - [Operational Technology (OT)](https://csacyber.com/specialist-services#operational-technology) - [Cyber security for Private Equity](https://csacyber.com/specialist-services#mergers-and-acquisitions) - [Cyber training and education](https://csacyber.com/specialist-services#training-and-education) - [Virtual leadership](https://csacyber.com/specialist-services#leadership) - [Cyber Technologies](https://csacyber.com/cyber-technologies) - [SentinelOne Endpoint Detection & Response (EDR)](https://csacyber.com/cyber-technologies#sentinelone) - [AppGuard Endpoint & Server Zero Trust Protection](https://csacyber.com/cyber-technologies#appguard) - [Qualys Vulnerability Management as a Service (VMaaS)](https://csacyber.com/cyber-technologies#qualys-vmaas) - [Lookout Mobile Device Protection](https://csacyber.com/cyber-technologies#lookout) - [ThreatER DNS Protection](https://csacyber.com/cyber-technologies#threater-dns) - [Cyber Security Awareness & Training platform](https://csacyber.com/cyber-technologies#boxphish) - [About](https://csacyber.com/about-us) - [Careers](https://csacyber.com/careers) - [Certifications](https://csacyber.com/certifications-and-awards) - [Blog](https://csacyber.com/blog) - [Support Centre](https://csacyber.com/support) - Resources - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Partners](https://csacyber.com/partners) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) - [Contact](https://csacyber.com/contact-us) - Search Search Search September 26, 2024 3 min read time # Unauthenticated RCE on all GNU/Linux system – Should you be concerned? ![Simone Q](https://app.hubspot.com/settings/avatar/d41d8cd98f00b204e9800998ecf8427e) [Written by: Simone Q -](https://csacyber.com/blog/author/simone-q) [Vulnerability](https://csacyber.com/blog/tag/vulnerability) ![](https://csacyber.com/hubfs/1727384720922.png) ## Introduction On September 26th an Italian security researcher released details regarding an unauthenticated remote command execution (RCE) vulnerability affecting all GNU/Linux systems – Simone Margaritelli, known as evilsocket is a veteran of the infosec community, and you might probably know him as the father of Bettercap and Pwnagotchi projects (among others). He spent these last few weeks researching, reporting and coordinating with major platforms such as Canonical and RedHat. In this article we will summarise our understanding of the vulnerability (since things are still unfolding) and give you advices about how to check if you’re vulnerable and, especially, how to mitigate it.   ## The vulnerability The packages affected by the RCE are ‘cups-browsed’, ‘libcupsfilters’, ‘libppd ‘, and ‘cups-filters’ which are pre-installed and always listening for connection in several operating systems. The primary function of cups-browsed service is to automatically discover and manage network printers. This operation is performed in two main stages: 1. Printer discovery - either using the CUPS or Bonjour broadcast messages 2. Queue management – Once a printer is found, the application will create a link to the printer on the local machine The vulnerability is triggered in the second stage, when a printer is added, carrying a malicious PPD (Printer Privacy Policy URI), such as: *printer-privacy-policy-uri: |*        *https://www.google.com/"*        *\*FoomaticRIPCommandLine: "echo 1 \> /tmp/PWNED"*        *\*cupsFilter2 : "application/pdf application/vnd.cups-postscript 0 foomatic-rip* To trigger the command ‘*echo 1\>/tmp/PWNED*’ however, a print job must be sent started. ## Impact A remote unauthenticated attacker can silently replace existing printers’ (or install new ones) IPP URLs with a malicious one, resulting in arbitrary command execution (on the computer) when a print job is started (from that computer). The attacker could be either in the same local network on the vulnerable machine or find exposed 631 UDP ports on the Internet.   ## Are you affected? It is possible to check if your systems are running the vulnerable service by typing (on Debian / Ubuntu): *systemctl status cups-browsed* ![img1](https://csacyber.com/hs-fs/hubfs/img1.png?width=1101&height=287&name=img1.png) You can also check for cupsd’s listening ports via: *netstat -antup | grep cups* ![img2](https://csacyber.com/hs-fs/hubfs/img2.png?width=984&height=88&name=img2.png) Finally, check the installed version via: *cups-browsed --version* ![img3](https://csacyber.com/hs-fs/hubfs/img3.png?width=361&height=56&name=img3.png) If the running version of cups-browsed is \<= 2.0.1, you’re vulnerable to this attack.   ## Mitigation Until an official fix is released, you can disable the printing service by stopping the ‘cups-browsed’ daemon: *systemctl stop cups-browsed* *systemctl disable cups-browsed* ![img4](https://csacyber.com/hs-fs/hubfs/img4.png?width=755&height=68&name=img4.png) Finally, when the package maintainers will release the new patched version, you can upgrade via (in Ubuntu and Debian): *sudo apt update* *sudo apt upgrade*   ## References Fixes on OpenPrinting / cups - [https://github.com/OpenPrinting/cups/commit/96b3bdf010e78880f5764e5032720379aa1116df#diff-0156020e17b0508f5e90f5550a40f675b62c489f479486cc059ad657a9f0876dR3379](https://github.com/OpenPrinting/cups/commit/96b3bdf010e78880f5764e5032720379aa1116df#diff-0156020e17b0508f5e90f5550a40f675b62c489f479486cc059ad657a9f0876dR3379) Cups-browsed GitHub issue -[https://github.com/OpenPrinting/cups-browsed/issues/36](https://github.com/OpenPrinting/cups-browsed/issues/36 ) Researcher’s blogpost - [https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ ) Related Posts ## You may also like this [Similar Articles](https://csacyber.com/blog) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images%20%281%29.jpg?width=624&height=427&name=Blog%20images%20%281%29.jpg)](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) October 19, 2026 5 min read ### [When the sea becomes the battleground: What the Texas-bound tanker attacks tell us about OT security](https://csacyber.com/blog/when-the-sea-becomes-the-battleground-what-the-texas-bound-tanker-attacks-tell-us-about-ot-security) The recent cyber incidents involving two Texas-bound energy tankers may be one of the clearest... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/Blog%20images.jpg?width=624&height=427&name=Blog%20images.jpg)](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) October 16, 2026 14 min read ### [The attack surface has changed. The fundamentals have not.](https://csacyber.com/blog/the-attack-surface-has-changed.-the-fundamentals-have-not) Note from the author: Fair warning: this turned into a longer post than planned. I’m under no... [![Nathan Long](https://csacyber.com/hs-fs/hubfs/1722023909652.jpg?width=40&height=40&name=1722023909652.jpg) Nathan Long](https://csacyber.com/blog/author/nathan-long) [![](https://csacyber.com/hs-fs/hubfs/20230510-N1005919-Edit1.jpg?width=624&height=427&name=20230510-N1005919-Edit1.jpg)](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) August 24, 2026 2 min read ### [FluidOne Group appoints Charly Davis as Managing Director of CSA Cyber to advance its security-first strategy](https://csacyber.com/blog/fluidone-group-appoints-charly-davis-as-managing-director-of-csa-cyber-to-advance-its-security-first-strategy) Experienced industry leader joins FluidOne to strengthen integrated cyber, IT and secure networking... [![CSA Cyber](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Stacked.png?width=40&height=40&name=CSA%20Cyber%20Logo%20FNL_Stacked.png) CSA Cyber](https://csacyber.com/blog/author/csa-cyber) [![CSA Cyber Logo FNL\_Full Logo](https://csacyber.com/hs-fs/hubfs/CSA%20Cyber%20Logo%20FNL_Full%20Logo.png?width=3463&height=1248&name=CSA%20Cyber%20Logo%20FNL_Full%20Logo.png "CSA Cyber Logo FNL_Full Logo")](https://csacyber.com/) Established in 2013, Cyber Security Associates Limited trading as CSA Cyber provides cyber consultancy and cyber managed services which help to detect, protect and educate against the ever-changing cyber threat. We have built our team from a foundation of Government (ex-Military) and Commercially experienced specialists all holding current and relevant cyber certifications. Today our core services are based around a 24/7 Security Operations Centre (SOC) based in Gloucester. #### News & Resources - [Blog](https://csacyber.com/blog) - [Case Studies](https://csacyber.com/case-studies) - [Downloads & Reports](https://csacyber.com/downloads-and-reports) - [Webinars](https://csacyber.com/webinars) - [Careers](https://csacyber.com/careers) - [Cyber Bundles (IT MSPs)](https://csacyber.com/cyber-bundles) #### Quick Links - [About Us](https://csacyber.com/about-us) - [Certifications](https://csacyber.com/certifications-and-awards) - [Our Parent Company](https://www.fluidone.com) - [Partners](https://csacyber.com/partners) - [Contact Us](https://csacyber.com/contact-us) - [Anti Bribery Policy](https://csacyber.com/hubfs/CSAAnti-BriberyPolicy.pdf) - [Complaints Policy](https://csacyber.com/hubfs/CSAComplaintsPolicy.pdf) - [Corporate Social Responsibility Policy](https://csacyber.com/hubfs/CSACorporateSocialResponsibilityPolicy.pdf) - [Slavery and Human Trafficking Statement](https://csacyber.com/hubfs/CSASlaveryandHumanTraffickingStatement.pdf) - [NCSC CHECK Status Verification](https://www.ncsc.gov.uk/organisation/csa-cyber/check-penetration-testing) - [CREST Approved Certification Verification](https://www.crest-approved.org/member_companies/csa-cyber/) #### Contact Information **United Kingdom - London** Cyber Security Associates Ltd 5 Hatfields, London, SE1 9PG   **United Kingdom - Gloucester** Cyber Security Associates Ltd Unit 11, Wheatstone Court, Waterwells Business Park, GL2 2AQ   **Phone:** [+44(0) 300 303 4691](tel:03003034691) **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   **United States of America** Cyber Security Associates Inc. 6010 W. Spring Creek Pkwy, Plano, Texas, 75024   **Phone:** [+1 469 750 1695](tel:14697501695)  **Email:** [hello@csacyber.com](mailto:hello@csacyber.com)   [![trust-pilot](https://csacyber.com/hs-fs/hubfs/trust-pilot.png?width=178&height=104&name=trust-pilot.png)](https://uk.trustpilot.com/review/csa.limited)   --- - [Website Terms of Use](https://csacyber.com/website-terms-of-use) - [Website Privacy Policy](https://csacyber.com/privacy-notice) - [Website Cookie Policy](https://csacyber.com/cookie-policy) Copyright 2026. Cyber Security Associates Ltd [Follow us on Facebook](https://www.facebook.com/CSALIMITED/) [Follow us on LinkedIn](https://www.linkedin.com/company/csa-cyber/) [Follow us on Twitter](https://twitter.com/cybersecurityis) [Follow us on Facebook](https://www.youtube.com/@cybersecurityassociateslim) [Follow us on Facebook](https://www.instagram.com/cybersecurityassociates) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Simone Q", "url" : "https://csacyber.com/blog/author/simone-q" }, "dateModified" : "2024-12-09T10:42:42.479Z", "datePublished" : "2024-09-26T04:30:00.000Z", "headline" : "Unauthenticated RCE on all GNU/Linux system – Should you be concerned?", "image" : [ "https://csacyber.com/hubfs/1727384720922.png" ], "mainEntityOfPage" : { "@id" : "https://csacyber.com/blog/unauthenticated-rce-on-all-gnu/linux-system-should-you-be-concerned", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://csacyber.com/hubfs/csacyber-logo-black-01.svg" }, "name" : "Cyber Security Associates Ltd" } } ```