According to a vulnerability report made to US-CERT by researcher Neil Smith, Samsung printers -- as well as some Dell printers manufactured by Samsung -- contain a "hard-coded SNMP full read-write community string that remains active even when SNMP is disabled in the printer management utility."
The Simple Network Management Protocol (SNMP) is used to monitor the status of remote devices.
Using this backdoor account, a remote, unauthenticated attacker could access an affected device with administrative privileges, according to US-CERT. Such access could enable an attacker to make changes to the device configuration, gain access to sensitive information -- such as device and network information, credentials, and information passed to the printer -- and execute further attacks through arbitrary code.
Samsung and Dell have stated that models released after Oct. 31, 2012, are not affected by this vulnerability. Both companies said they will be releasing a patch tool later this year to address vulnerable devices.
Smith suggested that blocking the custom SNMP trap port of 1118/udp will help mitigate the risks posed by the backdoor.
Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.