The New Vulnerability that Creates a Dangerous Watering Hole in Your Network by Vectra AI Security Research team

Vectra Threat Labs disclosed a critical Windows vulnerability (CVE-2016-3238 / CVE-2016-3239) in the Point-and-Print/Internet Printing Protocol that permits an attacker to deliver malicious printer drivers which execute with system privileges, enabling remote infection and lateral movement; attackers can leverage compromised or fake printers, default credentials, or web-based vectors (e.g., malicious ads) to reach victims. Microsoft released a fix in Security Bulletin MS16-087 (12 July 2016); the report urges immediate patching and increased monitoring of IoT/printer traffic to mitigate this high-impact vector.