One Week, 23 Bugs: Researcher Achieves Remote Code Execution on Prusa MK4S

A software engineer found 23 distinct firmware defects in the Prusa MK4S in a single week, culminating in a fully fledged remote code execution chain that let him Rickroll his own printer from across the network. Prusa has patched every vulnerability ahead of a coordinated disclosure, shipping fixes in Buddy firmware versions above 7.0.0.

Yannick Dixken, a freelance cloud architect and DevOps engineer who describes security research as a hobby, spent one intense week attacking his MK4S in the name of science. His toolkit was minimal: Claude Opus 4.8 and a fuzzer, alongside a week of debugging and reverse engineering.

The tally, in his own words: "14 findings, roughly 23 individual defects, and a chain that ends with the printer's main controller running code I sent it over the network." Then the punchline. "Yup, fully fledged RCE."

He published the results in a detailed, amusingly titled blog post, Never gonna print you up!, coordinated with Prusa and accompanied by a proof-of-concept video that he also sent directly to the company.

How bad was the headline bug?

The flagship vulnerability scored 8.1 on the severity scale and carries an official High Severity rating. It sat not in the printer's embedded code alone but in Prusa Connect, the cloud-based — or self-hostable — management platform that lets owners monitor and control their machines remotely.

Exploiting it meant the printer's main controller would execute attacker-supplied code delivered over the network. Dixken's demonstration chose the classic payload: the printer Rickrolls its owner. Harmless in this instance. The underlying capability was anything but.

What else did the audit turn up?

Beyond the RCE chain, the week of fuzzing cataloged a broader set of weaknesses in the Buddy firmware, including:

• A USB filename attack vector
• Heap overflows triggered by malformed encrypted print files
• Network denial-of-service flaws

Dixken observed that many of the bugs likely stemmed from the original developers' use of assert statements to enforce assumptions — a pattern that can mask error conditions in production builds rather than handle them safely.

The blog post outlines his methods in full for readers who want to replicate or extend the work.

How did Prusa respond?

Within 24 hours of the Rickroll video appearing on social media, Prusa's team was in contact. Dixken credits the company with handling the disclosure professionally, efficiently and kindly — a response he notes is not universal among vendors confronted with flaws in their own products.

The coordination paid off on the user side. All identified vulnerabilities are now patched, and users running Buddy firmware above 7.0.0 are covered. Owners of affected Prusa printers should confirm their firmware version and update if they haven't.

The episode also lands at an awkward intersection for connected hardware: a printer that accepts encrypted print jobs, mounts USB storage and listens on the network is a computer, and it gets audited like one. A week of hobbyist effort with an AI assistant and a fuzzer surfaced more than twenty defects in a mature product line — a data point other device vendors, and not just in 3D printing, will want to sit with as responsible-disclosure research increasingly targets embedded consumer firmware.