A freelance engineer's week with a fuzzer turned up roughly 23 defects in the software around the Prusa MK4S 3D printer, including a remote code execution bug he used to Rickroll the machine.
Yannick Dixken is a Freelance Cloud Architect, DevOps and Platform Engineer who treats security research as a hobby. He spent a week debugging, fuzzing (feeding software malformed input to see what breaks) and reverse engineering, armed, he wrote, with Opus 4.8 and a fuzzer. His tally: 14 findings, roughly 23 individual defects, and a chain that ends with the printer's main controller running code he sent over the network.
The headline bug scored 8.1 and is officially rated High Severity. It sat in Prusa Connect, the cloud or self-hosted management platform. The rest of the list includes a USB filename attack, heap overflows (memory corruption) triggered by malformed encrypted print files, and network denial-of-service flaws. Dixken published a blog post titled Never gonna print you up! in coordination with Prusa, and every issue is patched in Buddy firmware versions after 7.0.0.
Many of the bugs were probably symptoms of the original developers leaning on assert statements, which are checks that a condition holds, to enforce assumptions. That reading fits the list. An assumption survives friendly input, and the flaws here arrived through malformed files and network traffic, which is exactly what an attacker supplies.
Prusa's handling is the other half of the story. Dixken said the company's team coordinated professionally, efficiently and kindly within 24 hours of the Rickroll video circulating on social media. Not every vendor treats outside researchers that way.
The broader lesson is about what a printer has become. A machine on a home network that accepts files over USB, the cloud and the local network has three separate front doors, and this week of testing suggests each one deserved more scrutiny than it got before release.