## https://sploitus.com/exploit?id=2B9EC353-CF5D-5AEC-9541-42F0F1CE5FEC
## CVE-2026-39047: Epson Printer RAW Protocol Exploit Framework
**Repository:** [https://github.com/J4ck3LSyN-Gen2/CVE-2026-39047](https://github.com/J4ck3LSyN-Gen2/CVE-2026-39047)
**PoC Script:** `poc.py`
**Mock Target:** `mock_printer.py`
**Author:** [_J4ck3LSyN_](https://x.com/J4ck3LSyN)
### Overview
This framework demonstrates the **CVE-2026-39047** vulnerability - a remote buffer overflow in Epson multifunction printers (notably the L14150 FL27PB) when processing malformed or oversized payloads over the RAW TCP printing protocol (typically port 9100).
Successful exploitation can lead to arbitrary code execution in the printer's embedded environment, enabling:
- Denial of Service (DoS) / device crash/reboot
- Command execution / shell access (in staged scenarios)
- Persistence mechanisms
- Network pivoting or data exfiltration from compromised print infrastructure
The PoC focuses on **transport framing**, **payload obfuscation**, **fuzzing techniques**, and **staged post-exploitation** behaviors suitable for red teaming, vulnerability research, and defensive testing.
---
> [!WARNING]
> - This tool can (and will) lead to remote code execution (RCE) on vulnerable printers.
> - __Unauthorized__ use, _scanning_, or _exploitation_ of systems you do __NOT__ own or have __EXPLICIT WRITTEN PERMISSION__ to test is __ILLEGAL__
> and may violate __computer fraud and abuse laws__ (e.g., __CFAA in the US__), __data protection regulations__, and __organizational policies__.
> The __author__ assumes __NO LIABILITY__ for any _damage_, _data loss_, _service disruption_, or _legal consequences_ resulting from the use or misuse of this code.
> - Use __only__ in __isolated lab__ environments with __devices__ you control.
> - __Always__ obtain __explicit authorization__ before any testing.
> - The code includes _dry-run_ and _passive_ modes to aid __safe__ analysis.
> __Responsible disclosure and ethical use are strongly encouraged.__
> - Patch your devices promptly once vendor updates are available.
> - Printers often sit on internal networks with high trust and limited monitoring, making them attractive attack surfaces.
### Vulnerability Details
- **Affected Product:** EPSON L14150 (firmware FL27PB and likely similar models)
- **Vector:** RAW Printing Service (JetDirect-like) on TCP/9100
- **Impact:** Remote Code Execution (RCE) via stack-based buffer overflow
- **CVSS:** High severity (details available on NVD)
- **Root Cause:** Insufficient bounds checking on incoming print job data/frames in the printer's firmware
**References:**
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-39047
- Related advisories and reports (search for the CVE ID)
### Features
- **Printer Profiling:** Probes target for reachability and basic model/firmware info using PJL commands.
- **Payload Generation:**
- Multiple techniques: cyclic patterns, format strings, NOP sleds, random data.
- Obfuscation layer (zlib + XOR + Base64 with dynamic keys).
- Custom transport framing (`PRT2` protocol).
- **Delivery Modes:**
- Chunked sending with randomized delays (evasion-friendly).
- Dry-run mode (no network traffic).
- **Campaign Options:**
- Passive reconnaissance.
- Fuzzing with variable sizes and techniques.
- Post-exploitation staging (shell, beacon, persistence simulation).
- **Mock Printer:** `mock_printer.py` for safe local testing (crashes on oversized payloads).
### Prerequisites
- Python 3.8+
- No external dependencies (uses standard library only: `socket`, `asyncio`, `argparse`, `zlib`, `hashlib`, etc.)
### Installation / Setup
1. Clone the repository:
```bash
git clone https://github.com/J4ck3LSyN-Gen2/CVE-2026-39047.git
cd CVE-2026-39047
```
2. Make scripts executable:
```bash
chmod +x poc.py mock_printer.py
```
3. (Optional) Test with mock printer in one terminal:
```bash
./mock_printer.py
```
### Usage
```bash
./poc.py -t <TARGET_IP> [OPTIONS]
```
#### Key Arguments
| Option | Description |
|--------|-------------|
| `-t, --target` | Target IP address (required) |
| `-p, --port` | Port (default: 9100) |
| `--passive` | Passive recon mode (send probe payloads only) |
| `--fuzz` | Enable multi-technique fuzzing |
| `--hijack` | Enable post-exploitation staging |
| `--objective` | `stage1` \| `shell` \| `beacon` \| `persistence` |
| `--callback` | Optional callback identifier/string |
| `--capability` | `minimal` \| `busybox` \| `linux` (affects command wrapping) |
| `--dry-run` | Generate payloads but do **not** send |
| `--techniques` | Space-separated list (e.g., `cyclic format sled random`) |
| `--delay` | Delay between payloads in seconds (default: 1.6) |
**Examples:**
- Basic baseline test:
```bash
./poc.py -t 192.168.1.100
```
- Fuzzing run:
```bash
./poc.py -t 192.168.1.100 --fuzz --techniques cyclic random
```
- Staged hijack (lab only):
```bash
./poc.py -t 192.168.1.100 --hijack --objective shell --dry-run
```
- Full campaign with mock target:
```bash
# Terminal 1
./mock_printer.py
# Terminal 2
./poc.py -t 127.0.0.1 --fuzz --hijack --objective stage1
```
### Technical Implementation Highlights
- **Transport:** `bTransportFrame()` wraps payloads with `PRT2` header + length.
- **Obfuscation (`lObf`):** zlib compression → dynamic XOR mask (seed-derived) → Base64.
- **Payload Builders:** `gModernPayload()` and `gPostPayload()` for various patterns and staged commands.
- **Staging:** Generates shell commands for runtime directories, config files, and persistence hooks (simulated).
- **Async Delivery:** Chunked transmission with jitter for realism.
See inline docstrings and code comments for deeper details.
### Detection / Mitigation
- **Detection:** Monitor TCP/9100 for anomalous payload sizes, unusual PJL commands, or repeated connections from unexpected sources. Look for `PRT2` framing patterns.
- **Mitigation:**
- Apply firmware updates from Epson as soon as available.
- Network segmentation: Isolate printers from general user networks.
- Firewall rules limiting port 9100 to trusted print servers.
- Disable RAW protocol if not required; prefer secure alternatives (IPPS, etc.).
- Regular firmware auditing and printer inventory.
### Disclaimer (Repeated)
This PoC is provided **strictly for educational, research, and authorized security testing purposes**. Misuse may result in severe consequences. The repository owner is not responsible for any damage caused.