External risk intelligence

Sagemcom F@st 3686 ippprint Buffer Overflow Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-29329

The vulnerability exists in the Internet Printing Protocol (IPP) service of a consumer residential gateway device. Such services are often exposed on the WAN interface or are part of the device's management/service surface, making them commonly reachable in internet-facing deployment patterns for these appliances.

Buffer Overflow

Sagemcom F\@st 3686 Firmware

4.121.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This CVE involves a critical vulnerability in the Internet Printing Protocol service of Sagemcom devices that could allow a remote attacker to execute arbitrary code. The issue stems from a buffer overflow, which is a common type of software flaw that can be exploited to compromise systems. Given the potential for code execution, it is important to understand the relevance of this vulnerability to our environment.

Code execution flaw in printing service.
Critical flaw may impact internet-connected devices.
Confirm if these specific devices are in use.

Attack Path

How an attacker could exploit the issue

An attacker can exploit a buffer overflow vulnerability in the Internet Printing Protocol (IPP) service of Sagemcom devices. This service is often exposed on the internet, allowing remote attackers to send specially crafted HTTP requests. By sending such a request, an attacker could trigger the vulnerability, potentially leading to the execution of arbitrary code on the affected device.

Vulnerability exposed on the network.
Triggered by crafted HTTP requests.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could execute arbitrary code on the affected device by sending a specially crafted HTTP request to the ipprint service. This could impact the device's functionality and any services it provides.

Affected system data.
Crafted HTTP request to the service.
Remote code execution on the device.

Operational Fix

Recommended remediation, mitigation, and detection steps

The ipprint service in Sagemcom F@st 3686 firmware is susceptible to a critical buffer overflow vulnerability. This threat requires immediate attention from infrastructure and network security teams, as it allows remote, unauthenticated code execution. The initial focus should be on identifying all instances of the affected device, assessing their exposure, and confirming business criticality to prioritize remediation efforts.

Infrastructure and network teams own remediation.
Verify WAN exposure and business criticality first.
Plan coordinated vendor engagement and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sagemcom F@st 3686 and the ippprint service?

The Sagemcom F@st 3686 is a residential gateway device, commonly used as a router or modem to provide internet connectivity in homes. It includes an ippprint service, which handles the Internet Printing Protocol. This service is designed to allow network-attached printers or similar devices to communicate with the gateway, effectively managing print jobs across the local network.

What does the buffer overflow vulnerability mean in CVE-2025-29329?

This vulnerability is classified as CWE-120, a classic buffer overflow. It occurs when the ippprint service fails to properly check the size of data being written into a reserved memory space. If a sender provides more data than the service expects, it can overwrite adjacent memory. In this CVE, that memory corruption can be manipulated to force the device to run unauthorized code instructions, essentially bypassing the intended software logic.

How is this vulnerability triggered?

The vulnerability is triggered when the affected ippprint service receives a specially crafted HTTP request from a remote source. Because the service does not properly validate the structure or size of this incoming request, it creates the error conditions necessary for a buffer overflow. Simply accessing the device's main web interface or using standard, legitimate internet features does not trigger this specific flaw; it requires a request specifically designed to exploit this memory weakness.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is particularly relevant for residential gateways because the Internet Printing Protocol service is frequently reachable via the device's WAN interface. If your device is configured to expose management or service ports to the public internet, it is at higher risk. Devices restricted to internal, private network access have a significantly smaller attack surface compared to those directly reachable from the open internet.

What are the first steps to address CVE-2025-29329?

Your priority should be identifying whether you have Sagemcom F@st 3686 devices running firmware version 4.121.0 in your environment. Once identified, assess their connectivity to ensure they are not directly exposed to the internet. Coordinate with your network administration teams to restrict access to the affected printing services and check with the vendor for official firmware updates or configuration guidance to resolve the underlying memory flaw.

References

github.com/SilverS3c/Sagemcom-fast-3686-ippprint

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.