CVE-2021-42913
📋 TL;DR
This vulnerability in Samsung SCX-6x55X printers allows unauthenticated attackers to access SMB user credentials stored in cleartext by viewing HTML source code through the SyncThru Web Service. It affects organizations using these printers with SMB file sharing enabled. No authentication is required to exploit this weakness.
💻 Affected Systems
- Samsung SCX-6x55X series printers
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to SMB credentials, potentially leading to lateral movement within the network, data exfiltration, or ransomware deployment across connected systems.
Likely Case
Attackers harvest SMB credentials to access shared network resources, potentially compromising sensitive documents and files accessible via those credentials.
If Mitigated
With proper network segmentation and access controls, impact is limited to the printer itself and isolated network segments.
🎯 Exploit Status
Exploitation requires only web browser access to printer's web interface; no special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Samsung security advisory for specific firmware versions
Vendor Advisory: https://security.samsungmobile.com/securityUpdate.smsb
Restart Required: Yes
Instructions:
1. Access printer web interface 2. Navigate to firmware update section 3. Download latest firmware from Samsung 4. Upload and install firmware 5. Reboot printer
🔧 Temporary Workarounds
Disable SyncThru Web Service
allTurn off the vulnerable web service interface
Access printer web interface > Settings > Network > Web Service > Disable
Disable SMB file sharing
allRemove SMB configuration to eliminate credential exposure
Access printer web interface > Settings > Network > File Sharing > Disable SMB
🧯 If You Can't Patch
- Network segment printers away from critical systems using VLANs or firewall rules
- Implement strict network access controls to limit printer web interface access to authorized IPs only
🔍 How to Verify
Check if Vulnerable:
Access printer web interface, view page source, search for SMB credentials in HTMLCheck Version:
Access printer web interface > Settings > System > Firmware VersionVerify Fix Applied:
After patching, attempt to access HTML source and verify SMB credentials are no longer exposed📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts to printer web interface
- Unusual access patterns to printer web pages
Network Indicators:
- HTTP requests to printer web interface from unauthorized IPs
- Traffic patterns suggesting credential harvesting
SIEM Query:
source="printer_web_logs" AND (url="*view-source*" OR status=200) AND user_agent="*browser*"🔗 References
- https://medium.com/%40windsormoreira/samsung-printer-scx-6x55x-improper-access-control-cve-2021-42913-bd50837e5e9a
- https://security.samsungmobile.com/securityUpdate.smsb
- https://medium.com/%40windsormoreira/samsung-printer-scx-6x55x-improper-access-control-cve-2021-42913-bd50837e5e9a
- https://security.samsungmobile.com/securityUpdate.smsb
