Anycubic 3D printers hacked in bold attempt to inform owners of security hole

One of the impacted Anycubic 3D printers, pointing users to a readme file alerting them of the issue.
One of the impacted Anycubic 3D printers, pointing users to a readme file alerting them of the issue. (Image credit: u/Mr_0verwrite on Reddit)

According to users of the subreddit for Anycubic 3D printers, a very significant exploit has been uncovered by hackers — though fortunately, they only seem to be using it to leave a message drawing attention to the issue. As noted by Bleeping Computer, users are being pointed toward a readme file on the display of their 3D printer that alerts them of the security issue and advises them to disconnect it from the Internet until a patch is released that actually fixes the problem.

Unfortunately, it seems like this has been an issue for quite some time. According to a forum post cited by BC on the matter, users "have attempted to communicate with Anycubic regarding two critical security vulnerabilities we identified, in particular one can be found catastrophic if found by a malicious (party). Despite our efforts over the past two months, we have not received a single response."

Those same users (potentially our very same hackers), then said "Consequently, we are now preparing to disclose these vulnerabilities to the public along with our repo and our tools." Some hours after the hacked messages warning of the issue started to appear, Anycubic's app stopped working due to a "network unavailable" error message, which may have been caused by this issue.

A few Anycubic printers make our own roundup of the best 3D printers and best budget 3D printers, and the company has considerable market share. According to Bleeping Computer, the company has around 1,000 employees and is one of the most popular brands on the market, with more than 3 million 3D printers sold if Anycubic's claims are to be believed.

Regardless of sales success, though, it seems pretty important that Anycubic take care of this quickly. 3D printers are expensive machines, and according to the hacked message left, the exploit could effectively be used to "rm (presumably Unix "rm", or remove files) your whole printer" or place a startup script inside of it. 

Fortunately, the people on the hacking end of this issue only sought to draw users' attention to it; a malicious party could have been actively exploiting this for months without drawing anybody's attention, if they so pleased.

Update, Feb. 29, 2024, 1:35 p.m. ET: This article previously said Anycubic wasn't on our list of the best 3D printers. This was incorrect and has been updated. We regret the error.

MORE: Best 3D Printers

MORE: Best Budget 3D Printers

MORE: Best Resin 3D Printers

  • AtrociKitty
    While no Anycubic printers make our own roundup of the best 3D printers, it does still have considerable market share.
    Anycubic is in the header image of that article, which lists both the Anycubic Photon Mono 2 and Anycubic Photon Mono M5s as some of the best printers.
    Reply
  • TheyCallMeContra
    AtrociKitty said:
    Anycubic is in the header image of that article, which lists both the Anycubic Photon Mono 2 and Anycubic Photon Mono M5s as some of the best printers.

    Writer here- that's my bad! I didn't write that roundup, thus I skimmed the "Quick List" at the beginning, which only covers the first 11 entries of that list- 12 and 13 are the two Anycubic printers you've identified in that piece. Will fix soon!
    Reply
  • edzieba
    3D printers are expensive machines, and according to the hacked message left, the exploit could effectively be used to "rm (presumably Unix "rm", or remove files) your whole printer" or place a startup script inside of it.
    Depending on the specific hardware in the printer, much more malicious exploits are possible. If hotend heater thermal runaway protection is not independent of the printer firmware, the printer could be maliciously commanded to constant maximum heating power - best case scenario there is a permanently damaged hotend, worst case is a fire spreading to the rest of the house. Axis motors can be driven to repeatedly slam into the ends of travel at maximum speed, etc. Damage can be far worse than just deleting a few gcode files left on the printer.
    Reply