CVE-2025-61915
📋 TL;DR
This vulnerability allows users in the lpadmin group to exploit an out-of-bounds write vulnerability in CUPS by modifying configuration files through the web UI. The cupsd process runs with root privileges, potentially leading to privilege escalation or system compromise. Systems running OpenPrinting CUPS versions prior to 2.4.15 are affected.
💻 Affected Systems
- OpenPrinting CUPS
📦 What is this software?
Cups by Openprinting
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via root privilege escalation leading to arbitrary code execution, data theft, or complete system takeover.
Likely Case
Privilege escalation from lpadmin group member to root, allowing unauthorized administrative access and configuration changes.
If Mitigated
Limited impact if lpadmin group membership is tightly controlled and web UI access is restricted.
🎯 Exploit Status
Exploitation requires authenticated access as lpadmin group member and knowledge of specific configuration manipulation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.15
Vendor Advisory: https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc
Restart Required: Yes
Instructions:
1. Download CUPS 2.4.15 from official repository. 2. Stop CUPS service: 'sudo systemctl stop cups'. 3. Install new version using package manager or compile from source. 4. Restart CUPS: 'sudo systemctl start cups'. 5. Verify version with 'cups-config --version'.
🔧 Temporary Workarounds
Restrict lpadmin group membership
linuxRemove unnecessary users from lpadmin group to limit attack surface.
sudo deluser <username> lpadmin
Disable CUPS web UI
linuxPrevent access to web interface that enables configuration changes.
sudo cupsctl --no-remote-admin
sudo systemctl restart cups
🧯 If You Can't Patch
- Restrict lpadmin group membership to essential users only.
- Disable CUPS web UI and use command-line tools for administration.
🔍 How to Verify
Check if Vulnerable:
Check CUPS version with 'cups-config --version' or 'dpkg -l | grep cups' and verify it's below 2.4.15.Check Version:
cups-config --versionVerify Fix Applied:
Confirm version is 2.4.15 or higher using 'cups-config --version'.📡 Detection & Monitoring
Log Indicators:
- Unusual configuration file modifications in /etc/cups/
- Failed privilege escalation attempts in system logs
- Unexpected cupsd process behavior
Network Indicators:
- Unusual web UI access patterns to CUPS port 631
- Multiple configuration change requests from single user
SIEM Query:
source="cups" AND (event="config_change" OR event="privilege_escalation")🔗 References
- https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.15
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc
- http://www.openwall.com/lists/oss-security/2025/11/27/5
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc
