Printers manufactured by Samsung have a backdoor administrator account hard coded in their firmware that could enable attackers to change their configuration, read their network information or stored credentials and access sensitive information passed to them by users.

The hardcoded account does not require authentication and can be accessed over the Simple Network Management Protocol (SNMP) interface of the affected printers, the U.S. Computer Emergency Readiness Team (US-CERT) said in a security advisory.

SNMP is an Internet protocol commonly used to monitor and read statistics from network-attached devices.

The SNMP account found in Samsung printers has full read and write permissions and remains accessible even if SNMP is disabled using the printer's management utility, US-CERT said.

"Secondary impacts include: the ability to make changes to the device configuration, access to sensitive information (e.g., device and network information, credentials, and information passed to the printer), and the ability to leverage further attacks through arbitrary code execution," the organization said.

It's not just Samsung-branded printers that contain the administrative account, but also some Dell-branded printers manufactured by Samsung.

Remind me again, is SNMP a routable protocol? If it isn't, you'd actually have to be on the same network segment as the printer to access the data.

Not sure what you mean there. SNMP goes over TCP/IP so it's routable, but you'd still need a route to get to it. Also, the article implies that it's not SNMP that's the problem per say. It's that the SNMP user has full access rights to the admin interface.

I doubt many people arbitrarily port-forward to their printers so an external attack isn't that likely, but it's still a bit naff to have a hard-coded back door. Naff... but not unusual!

I suspect there are far more of the printers that are vulnerable to this exploit visible on the internet than either of us would hope.

This one?

This one is also interesting.

A quick scan of unprotected printers left open to Internet attack by the researchers found 40,000 devices that they said could be infected within minutes