5 Security Hardening Tips for Network-Connected Printers

The Ransomware Nightmare Triggered by a Single “Silent Printer”

In late autumn 2019, Lao Zhou, the IT manager at a technology company in Wangjing, received an urgent call from the sales team — every printer in the office had “gone on strike” at once, each screen displaying an encryption notice that demanded 0.5 bitcoin for the decryption key. Stranger still, the company’s file server showed anomalous access logs the same night. After two full days of investigation, Lao Zhou discovered that the entry point was a network printer connected by an Ethernet cable — a device that had never been covered by any security policy and had run on the default admin/123456 password for three years, until that day it became the attacker’s stepping stone. This was no isolated case. In 2022, a manufacturing client in Beijing encountered a similar scenario: a printer was implanted with cryptomining software, its CPU usage ran at full capacity year-round, printing slowed to a crawl, and it took the operations team three months to pin down this “silent endpoint.” The printer — the most inconspicuous device in the corner of the office — is becoming the most vulnerable entry point into the corporate intranet.

The First Line of Defense: Start by Changing Default Passwords

Common commercial models on the market — HP LaserJet, Ricoh MP, Canon imageRUNNER, Xerox WorkCentre and the like — typically ship with default administrative passwords such as admin, 123456, blank, or a simple combination tied to the model number. Companies deploy them straight out of the box, and the password issue gets postponed for three to five years. The most extreme case I have seen: a client with more than 20 printers all sharing a single admin account, with the password written on a sticky note on the bottom of a printer — an attacker need only walk into the office area, take a photo, and gain access.

Once inside the printer’s web management interface, an attacker can do far more damage than “sneaking out a few pages”: redirect DNS to a phishing server, embed malicious macro code in print jobs, capture plaintext print job data over the IPP protocol, or even hijack the LDAP configuration to obtain domain account hashes — the well-known “printer-based lateral movement” technique. With domain hashes in hand, combined with an NTLM relay attack, an attacker can impersonate domain controller privileges and cause widespread damage.

The first step in hardening is blunt and simple: after purchasing or deploying new equipment, change every default credential immediately, and maintain a “device–account–password” ledger that is included in the handover checklist. If your printers are still running on default passwords, change them now — and while you’re at it, test whether Telnet/SSH login is still possible. Our Network Equipment Package service includes a basic security hardening process before deployment that covers exactly this step.

SNMP Permissions: The Overlooked Intelligence Channel

Printer SNMP (Simple Network Management Protocol) is a genuinely useful thing — it lets IT administrators query device status, toner levels, and paper capacity in bulk. The problem is that SNMP v1 and v2c, which are enabled by default, offer no encryption whatsoever; the community string defaults to public/private, travels in plaintext, and can be harvested by any off-the-shelf scanner.

Information an attacker can obtain via SNMP includes: IP address, MAC address, printer model, firmware version, installed firmware modules, network configuration, and printer share name — and even sensitive data left over from historical print jobs. A security team once ran a test: with nothing but a default SNMP community string, ten minutes of probing on the internal network was enough to map out a complete printer asset topology — including the floor, department, and switch port of every device. To an attacker, that map is priceless, and far more accurate than any scanning tool.

Hardening advice: open the printer management interface and change the SNMP v1/v2c community string to a complex string of at least 16 characters — or simply disable SNMP v1/v2c altogether and keep only SNMP v3 with authentication and encryption enabled. If business systems depend on SNMP monitoring, be sure to confirm that the monitoring platform has been updated to v3 credentials as well. Lao Zhou later changed the SNMP community on every printer in the company to a 32-character random string; he said he slept particularly soundly that night.

1. Log in to the printer’s web management interface → Network Settings → SNMP Configuration
2. Disable SNMP v1/v2c, or change the community string to a strong password
3. Enable SNMP v3 and configure authentication (MD5/SHA) plus encryption (DES/AES)
4. Confirm that all monitoring platforms use SNMP v3 credentials
5. Regularly audit SNMP access logs and investigate anomalous query sources

Port 9100: A Time Bomb Hidden in the Corner

Port 9100 is the default port for the RAW printing protocol (also called the 9100 printing service), and virtually every network printer listens on it by default. The upside is high transfer efficiency and good compatibility — send print data straight to port 9100 and pages come out. The downside is equally obvious: the port has no authentication mechanism whatsoever, so anyone who can reach it can pump data into it.

An attacker can send malicious data directly to port 9100 to trigger known vulnerabilities, or simply deliver Office documents and PDF files containing malicious macros. At a 2021 security conference, researchers demonstrated delivering a specially crafted document to an unpatched HP printer through port 9100, successfully executing arbitrary code on the printer’s embedded system and then reading print job data from the printer’s memory — including payroll slips, scanned contracts, and confidential memos.

There are two hardening approaches. First, prevent port 9100 from being exposed to unauthorized IPs — restrict access to printer port 9100 in the firewall or switch ACL so that only the print server’s IP can reach it. Second, where business requirements allow, disable RAW printing entirely and switch to more secure alternatives such as IPP (Internet Printing Protocol, Port 631) or LPD (Line Printer Daemon, Port 515). My recommendation is to keep IPP for web printing, remove 9100 from the firewall rules, and allow access only from specific IP ranges. Where 9100 genuinely must be retained, encapsulate the traffic in a VPN tunnel rather than leaving it exposed on the office network.

VLAN Isolation: Locking Printers in a “Cage”

When most small and medium-sized businesses plan their networks, switch ports are plugged in wherever convenient, and printers end up on the same subnet as employee computers and servers. This “flat” architecture is easy to manage, but it also plants enormous lateral movement risk. The moment a printer is compromised, the attacker can immediately scan every device on that subnet — SMB shares, RDP services, database ports… all within easy reach.

The correct approach is to place printers in a dedicated VLAN, fully isolated from office endpoints, business systems, and the server domain. All print traffic is routed through one or several print servers; employee computers communicate only with the print server, and the print server in turn talks to the printers on each floor and in each department over the dedicated VLAN. That way, even if a printer falls, the attacker can only circle within the printer VLAN — penetrating the office or server network means crossing Layer 3 routing and ACLs, which is no small feat.

In practice, plan a dedicated VLAN for printers (VLAN 30, for example, as the printer subnet), configure Layer 3 routing on the core switch, and apply an ACL whitelist policy from the office network to the printer VLAN that permits only the print server’s IP. Clients with the capability can also enable 802.1X authentication so that printers require identity verification to join the network, eliminating unauthorized devices entirely. Our sTrust Zero Trust Security solution includes a complete network access control practice that manages device onboarding security at the root.

Firmware Updates: Don’t Leave Vulnerabilities Waiting There

In May 2022, SentinelLabs disclosed a critical vulnerability (CVE-2022-3942) affecting dozens of HP printer models: an attacker needed only to send a malicious packet to achieve remote code execution, and the affected firmware versions spanned several years. In 2023, CISA (the U.S. Cybersecurity and Infrastructure Security Agency) went further and issued a direct warning about exploitable RCE vulnerabilities in mainstream commercial printers, advising organizations to update firmware immediately. The vendor patches are right there — yet in reality, a great many enterprise printers run firmware that is three to five years old, with vulnerabilities that have never been fixed.

The reasons firmware goes unpatched are entirely practical: printers, unlike PCs, don’t pop up reminders. Updating firmware means manually downloading the firmware package, logging into the management interface to upload it, and rebooting the device — a process that interrupts printing service for ten minutes or more each time, so many operations staff set it aside as too much trouble. Worse still, firmware updates on certain older printer models can go wrong and brick the device, leaving operations staff reluctant to touch them.

We recommend that organizations establish a quarterly printer firmware inspection routine: check each vendor’s official website for the latest firmware version and known vulnerability advisories for the relevant models (HP publishes PSRT reports, Xerox issues security bulletins), and test and deploy security patches promptly. For models that have reached end of security support (where the vendor no longer issues patches), add them to a replacement plan, and when purchasing new equipment, prioritize products with built-in secure boot and automatic update capabilities.

There is no silver bullet for printer security, but changing a passive, silent posture is not difficult. Change the default passwords, tighten SNMP permissions, tuck port 9100 away, give printers their own VLAN room, and build the habit of updating firmware — do these five things and the average script kiddie will most likely give you a wide berth. A truly determined APT attack costs far more, and for most small and medium-sized businesses the asset value simply doesn’t justify an attacker placing such a heavy bet.

If reading this article brought to mind a dusty old printer sitting in some corner of your office, and you started to feel uneasy, then go make that change. It really isn’t hard.