Join for quick access. Enter your email below and we'll send confirmation plus sign you up to our newsletter.
By submitting your information, you confirm you are aged 16 or over,
have read our
Privacy Policy
and agree to the
Terms & Conditions. Geographical rules apply.
Join for quick access. Enter your email below and we'll send confirmation plus sign you up to our newsletter.
By submitting your information, you confirm you are aged 16 or over,
have read our
Privacy Policy
and agree to the
Terms & Conditions. Geographical rules apply.
Stay On the Cutting Edge: Get the Tom's Hardware Newsletter
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.
You are now subscribed
Your newsletter sign-up was successful
Join the club
Get full access to premium articles, exclusive features and a growing list of member rewards.
An account already exists for this email address, please log in.
Software engineer Rickrolls his Prusa 3D printer via remote code execution exploit — one week of testing with Claude Opus uncovers 23 Prusa Buddy firmware defects
Software engineer Yannick Dixken spent a week attacking his Prusa MK4S 3D printer in the name of science. At the end of the relatively short but intense period, he produced a video demonstrating the ability to Rickroll the printer via remote code execution (RCE). Dixken shared the video and findings – charting “roughly 23 individual defects” with Prusa and published his amusing but detailed Never gonna print you up! blog in coordination with the 3D printer maker. Yes, all the vulnerabilities are now patched in the Buddy firmware versions >7.0.0.
Dixken is an experienced Freelance Cloud Architect, DevOps and Platform Engineer. Security research is more of a hobby, he notes in the blog post, but it is clearly a passion strong enough to spend a whole week probing the MK4S for vulnerabilities. The result is far more than the funny old Rickroll. The week of debugging, fuzzing and reverse engineering “armed with Opus 4.8 and a fuzzer” resulted in “14 findings, roughly 23 individual defects, and a chain that ends with the printer's main controller running code I sent it over the network,” noted Dixken. “Yup, fully fledged RCE.”
The headlining RCE scored 8.1 and is officially described as High Severity. This serious bug was in the cloud (or self-hosted) management platform called Prusa Connect. You can see proof-of-concept code Rickrolling the user in Dixken’s embedded video. He sent this video to Prusa.
The methods used to uncover these vulnerabilities are outlined in the source blog, if you’d like to know more. Meanwhile, there were many other vulnerabilities uncovered and cataloged. These include a USB filename attack, heap overflows triggered by malformed encrypted print files, and network denial-of-service flaws. Many of the bugs were probably symptoms of the original developers’ use of assert statements to enforce assumptions.
Happily for Prusa 3D printer users, Dixken has responsibly disclosed this multitude of vulnerabilities. The engineer says that within 24 hours of the Rickroll video being shared on social media, the 3D printing firm’s team coordinated professionally, efficiently, and kindly. Companies don’t always react so positively to those helping them find vulnerabilities in their wares.
Mark Tyson is a news editor at Tom's Hardware. He enjoys covering the full breadth of PC tech; from business and semiconductor design to products approaching the edge of reason.
