# IPP / CUPS

> Network printing stack

- **URL:** https://hackindex.io/services/ipp-cups
- **Type:** Service
- **Default ports:** 631
- **Tags:** ipp, cups, printing, network, linux, service
- **Published:** 2026-01-26
- **Updated:** 2026-07-13

IPP (Internet Printing Protocol) is the standard protocol for network printing, and CUPS (Common UNIX Printing System) is the most widely used IPP implementation on Linux and macOS. IPP listens on **TCP port 631**. Nmap identifies the service as `ipp`. CUPS also provides a web-based administration interface on the same port.

Print servers are often overlooked during hardening but present real attack surface. Unauthenticated access to the CUPS web interface can reveal printer configurations, job histories, and network architecture details. Critical vulnerabilities in CUPS have allowed remote code execution, including the 2024 cups-browsed RCE chain (CVE-2024-47176 and related) that demonstrated how an attacker can create a malicious printer and execute commands when a print job is sent to it.

Enumeration involves browsing the CUPS web interface for printer lists, completed jobs, and configuration files. IPP attributes can be queried with `ipptool` to reveal make, model, firmware versions, and network details. Testing for unauthenticated admin access, job manipulation, and known CVEs are standard checks during a print service assessment.

## Phases

- [Enumeration](https://hackindex.io/services/ipp-cups/enumeration.md): Detect CUPS version, printers, queues, and extract user and host info (2 guides)
- [Vulnerability Discovery](https://hackindex.io/services/ipp-cups/vulnerability-discovery.md): CUPS admin exposure checks and CVE-2024-47176 RCE detection guides (2 guides)
- [Exploitation](https://hackindex.io/services/ipp-cups/exploitation.md): Exploit CVE-2024-47176 via cupshax to get RCE on CUPS (1 guides)