Security researcher Yannick Dixken discovered a chain of defects in Prusa 3D printer firmware that allows an attacker to achieve full remote code execution (RCE) on the printer's main controller. The most severe flaw, identified as PFB-008, stems from a stack overflow in the Prusa Connect service, which can be triggered by a specially crafted network command.
This screenshot demonstrates the researcher's successful proof of concept for achieving remote code execution.
Methodology and Discovery
Dixken spent a week analyzing the MK4S printer's firmware, using a combination of automated fuzzing and manual reverse engineering. The process involved compiling the firmware's parser code with AddressSanitizer to identify crashes and using a Cortex-M emulator to prove control flow before attempting to exploit physical hardware.
The researcher ran millions of mutated iterations against the G-code parsing path and the Prusa Connect HTTP requests. This systematic approach led to the discovery of 14 findings and roughly 23 individual defects across the firmware's network, USB, and memory management systems.
“A long SEND_FILE_INFO path overflows the Connect task's stack and runs attacker code from a controlled or intercepted Connect endpoint”
— Never gonna print you up!
The Prusa Connect Stack Overflow
The most critical finding, PFB-008, involves a `SEND_FILE_INFO` command sent via Prusa Connect. The controller's handler copies the command's path into a shared 512-byte buffer. While the code bounds this copy by the buffer size, it assumes the path string will not exceed 104 bytes.
In release builds, the `assert()` that enforces this 104-byte limit is compiled out. A path exceeding this limit pushes the filename slot off the end of the buffer and onto the pointer used by the command planner. Because the firmware lacks stack canaries or `_FORTIFY_SOURCE` protections, this allows the attacker to overwrite the pointer and redirect the printer's execution flow to their own code.
This image shows the visual result of the exploit running on the printer's hardware display.
Additional Vulnerabilities and Impact
Beyond the RCE, Dixken identified several other issues, including a USB-based stack overflow (PFB-007) and a heap buffer overrun in the encrypted G-code header (PFB-013). The latter allows an attacker to choose both the length and content of an overflow when the printer scans a print preview from a USB stick.
Other findings include a network-based denial of service (PFB-012) where an unauthenticated host can pin the Ethernet receive pool, stalling all networking services like PrusaLink and mDNS. These vulnerabilities affect users who utilize Prusa Connect for remote management or those who use USB sticks for file transfers.
Remediation and Status
Prusa has coordinated with the researcher to release these findings alongside official security advisories. All identified defects have been patched in Buddy firmware version 7.0.0. The researcher has requested CVE assignments for the findings, which are currently pending.