The Prusa MK4S printer, whose firmware was found to allow remote code execution via the Connect endpoint.
PRUSA MK4S 3D PRINTER RCE FOUND IN CONNECT ENDPOINT
*A week‑long audit by freelancer Yannick Dixken exposed 14 findings and roughly 23 defects in the Prusa MK4S. The most severe flaw lets an attacker execute code on the printer’s main controller via a crafted network request. Prusa has patched the bugs in Buddy firmware > 7.0.0.*
In August, freelance platform engineer Yannick Dixken spent a full week trying to break his own Prusa MK4S 3D printer. Using a fuzzer, AddressSanitizer‑compiled parsers and a Cortex‑M emulator, he uncovered a cascade of bugs that culminated in full remote code execution on the printer’s main controller. The audit produced 14 findings, roughly 23 individual defects across G‑code parsing, Prusa Connect, USB/FAT handling, transfer‑recovery, MMU and EEPROM. Three of the four most severe bugs were reproduced on the physical device, confirming a stack overflow that lets an attacker inject code via the network‑connected Prusa Connect endpoint.
What was the scope of the MK4S security audit?
Dixken began with the signed upstream image 6.5.7+12836 on his own MK4S, armed with Opus 4.8 and a fuzzer. He compiled the firmware's G‑code parser under AddressSanitizer, built a Cortex‑M emulator to run the real image, and fired millions of mutated G‑code lines and HTTP requests at Prusa Connect. The effort uncovered 14 distinct findings, roughly 23 individual defects across G‑code parsing, USB/FAT handling, transfer‑recovery, MMU and EEPROM. The most critical bugs emerged from user‑supplied input paths, especially the Connect endpoint.
Can a Prusa MK4S printer be remotely compromised?
Yes. The top vulnerability, catalogued as PFB‑008 with a CVSS 8.1 rating, lives in the Connect endpoint’s SEND_FILE_INFO path. A 463‑byte filename overflows a shared 512‑byte buffer, corrupting the planner’s printer pointer and allowing attacker‑controlled code to run on the main controller. Release builds drop a 104‑byte assert, enabling the overflow. Dixden reproduced the exploit on a physical MK4S, achieving full remote code execution over the network, either through a compromised Connect backend or a man‑in‑the‑middle attack.
How did Prusa respond to the disclosures?
Prusa coordinated the public release with Dixden and issued official security advisories. All findings were fixed in Buddy firmware versions greater than 7.0.0, and users with affected printers were urged to update immediately. Dixken submitted disclosure packages containing full write‑ups, PoC code and the tooling he built. He also requested CVE assignments for each finding, indicating a push for formal vulnerability tracking.
What does this reveal about 3D printer security?
The case shows that consumer‑grade 3D printers can harbor deep, network‑exposed flaws despite signed firmware. Attack surfaces such as G‑code parsers and cloud‑linked endpoints are fertile ground for exploitation. The need for rigorous input validation, stack‑size checks and timely firmware updates is stark. As printers become more connected, manufacturers must treat them as critical IoT devices, not hobbyist tools.
Frequently asked questions
What vulnerability allowed remote code execution on the Prusa MK4S?
A stack overflow in the Connect endpoint’s SEND_FILE_INFO path lets a 463‑byte filename overwrite a shared 512‑byte buffer, corrupting the planner’s printer pointer and enabling attacker‑controlled code execution.
How many defects did the researcher find in the MK4S firmware?
The audit uncovered 14 findings, roughly 23 individual defects across multiple components of the printer.
Has Prusa released a fix for the vulnerabilities?
Yes. All findings were fixed in Buddy firmware versions greater than 7.0.0, and users were urged to update immediately.
Prusa’s rapid patch rollout demonstrates responsible vendor response, but the episode underscores a broader risk: 3D printers are now networked appliances with attack surfaces comparable to other IoT devices. Users must stay vigilant, apply firmware updates promptly, and treat printer security as a priority rather than an afterthought. The industry will likely see more scrutiny as hobbyist hardware gains enterprise relevance.
Sources: Hacker News article "Never Gonna Print You Up" by Yannick Dixken