Never gonna print you up!

A security researcher found 14 vulnerabilities, totaling roughly 23 individual defects, in Prusa's MK4S 3D printer firmware during a week-long audit in August, including a full remote code execution chain that lets the printer's main controller run attacker-supplied code over the network. The most serious flaws surfaced in G-code parsing and Prusa Connect, with additional bugs in the USB and FAT paths, transfer-recovery code, and smaller defects in the MMU and EEPROM components. Prusa has fixed every finding in Buddy firmware version 7.0.0 and coordinated the disclosure with the researcher, who has requested CVE assignments for all findings. The research matters because it shows that networked consumer hardware like 3D printers carries meaningful attack surface through user-supplied input channels such as G-code and HTTP requests. Owners of affected printers should update to Buddy firmware 7.0.0 or later, and the pending CVE assignments will be the next milestone to watch.