{"vulnerability": "CVE-2012-5519", "sightings": [{"uuid": "0ebd200d-6d06-456f-ab8f-9982588586ad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5519", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:40.000000Z"}, {"uuid": "1f3a9a18-b0e4-4feb-ab17-2a7943e1df74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5519", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:09:09.000000Z"}, {"uuid": "e39252a3-f2ec-4c1d-b228-e6a8519e3228", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5519", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/multi/escalate/cups_root_file_read.rb", "content": "", "creation_timestamp": "2018-05-29T15:50:33.000000Z"}, {"uuid": "c8ee0d2f-2adc-48e2-8b4b-35752f72dd2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5519", "type": "published-proof-of-concept", "source": "https://t.me/tech_b0lt_Genona/4555", "content": "\u041e\u0442\u043b\u0438\u0447\u043d\u044b\u0439 \u043f\u043e\u0441\u0442 \u043f\u0440\u043e \u0440\u0430\u0441\u0447\u043b\u0435\u043d\u0451\u043d\u043a\u0443 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430. \u0422\u0430\u043c \u0432\u0441\u0451 \u043a\u0430\u043a \u043c\u044b \u043b\u044e\u0431\u0438\u043c: \u0436\u0435\u043b\u0435\u0437\u043e, \u043a\u043e\u0432\u044b\u0440\u044f\u043d\u0438\u0435 \u0432 \u0444\u0438\u0440\u043c\u0432\u0430\u0440\u0435 \u0438 \u043b\u0438\u043d\u0443\u043f\u0441\u0435, eval-\u044b \u0438 microPerl\n\nThis has ticked off something in my brain that immediately made me want to dig deeper, because... a brand new device? Shipping with a 2012 build of CUPS? Something's fishy.\n. . .\nExcuse me? I actually didn't notice the whole string at first, only later when closing excess windows. I was left dumbfounded at the sight: There's a CUPS version that's 10+ years old, Linux kernel almost old enough to drink, all of that running crawling on an ARMv5. On a device that's still in production, which you can buy right now.\n. . .\nFurthermore, I had a quick search for CUPS vulns around this vintage. Turns out that my version is the last one to be vulnerable to an Arbitrary File Read/Write vulnerability (often miscredited to CVE-2012-5519). \n. . .\nAs I expected, it was an ancient version of busybox. I thought about manipulating ErrorLog to leverage busybox's nc and append myself a remote shell to one of the initscripts, but I decided to check out our friends in CGI land first.\n. . .\nThe system is a custom buildroot environment, with a... peculiar selection of software. They've embedded busybox and microperl to cut on size, but then used full versions of OpenSSH, OpenSSL and CUPS. I can only assume that this project has been hot-potatoed through many underpaid engineers, and this does seem to track with what I found digging through the files\n\u0412 \u043e\u0431\u0449\u0435\u043c \u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0447\u0435\u043d\u044c \u043b\u0435\u0433\u043a\u043e \u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e, \u043c\u043e\u0433\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e\n\nPwning a Brother labelmaker, for fun and interop!\nhttps://sdomi.pl/weblog/20-pwning-a-labelmaker/\n+\nZink Wedge / Brother VC-500W RCE PoC (and other cool scripts)\nhttps://git.sakamoto.pl/domi/zinkpwn\n\n\u0421\u043f\u0430\u0441\u0438\u0431\u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0447\u0438\u043a\u0443 \u0437\u0430 \u0441\u0441\u044b\u043b\u043a\u0443", "creation_timestamp": "2024-07-05T12:33:18.000000Z"}, {"uuid": "ffe3e134-d0cd-40fe-9788-dfac3c4d6f48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2012-5519", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/post/multi/escalate/cups_root_file_read.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Jann Horn\", \"joev \"], \"autofilter_ports\": null, \"autofilter_services\": null, \"check\": false, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in CUPS < 1.6.2, an open source printing system.\\n          CUPS allows members of the lpadmin group to make changes to the cupsd.conf\\n          configuration, which can specify an Error Log path. When the user visits the\\n          Error Log page in the web interface, the cupsd daemon (running with setuid root)\\n          reads the Error Log path and echoes it as plaintext.\\n\\n          This module is known to work on Mac OS X < 10.8.4 and Ubuntu Desktop <= 12.0.4\\n          as long as the session is in the lpadmin group.\\n\\n          Warning: if the user has set up a custom path to the CUPS error log,\\n          this module might fail to reset that path correctly. You can specify\\n          a custom error log path with the ERROR_LOG datastore option.\", \"disclosure_date\": \"2012-11-20\", \"fullname\": \"post/multi/escalate/cups_root_file_read\", \"is_install_path\": true, \"mod_time\": \"2025-05-01 02:32:23 +0000\", \"name\": \"CUPS 1.6.1 Root File Read\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/post/multi/escalate/cups_root_file_read.rb\", \"platform\": \"Linux,OSX\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"multi/escalate/cups_root_file_read\", \"references\": [\"CVE-2012-5519\", \"OSVDB-87635\", \"URL-https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692791\"], \"rport\": null, \"session_types\": [], \"targets\": null, \"type\": \"post\"}", "creation_timestamp": "2026-09-08T06:52:41.359400Z"}]}