📦
审计历史
bambu-labs - 1 审计
审计版本 1 最新
2026年9月8日 12:31
The static results are false positives caused by Markdown syntax, documented private-network examples, and constrained local file or command handling. Two high-severity design risks remain: TLS peer verification is disabled by default, and printer access codes are written to plaintext configuration without restrictive permissions. No prompt injection, obfuscation, or malicious data-exfiltration intent was found.
7
已扫描文件
2,342
分析行数
6
复核项
0
已忽略误报
已确认安全问题 (2)
高
scripts/bambu_lan_print.py:377-385scripts/bambu_lan_print.py:944-951scripts/bambu_lan_print.py:1155-1183scripts/bambu_lan_print.py:1216-1229
Printer TLS Authentication Disabled by Default
FTPS, MQTT, and serial-discovery connections disable certificate verification unless users opt in. A local network attacker could impersonate the printer, capture its access code, or alter control traffic.
The code explicitly sets CERT_NONE and disables hostname checks before authenticating with the printer access code. This behavior occurs on every main TLS workflow by default.
高
Printer Access Code Stored Without Restricted Permissions
The configuration writer stores the printer access code as plaintext using default file permissions. Other local users or accidental repository inclusion could expose a credential that permits printer control.
The access code is assigned directly into the JSON object and write_text creates the file under the process umask. No chmod, secure secret store, or enforced ignore rule protects it.
风险因素
🌐 网络访问 (11)
⚙️ 外部命令 (50)
scripts/bambu_lan_print.py:583 SKILL.md:3 SKILL.md:12 SKILL.md:17 SKILL.md:18 SKILL.md:20 SKILL.md:26 SKILL.md:27 SKILL.md:33 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:41 SKILL.md:46-53 SKILL.md:53-57 SKILL.md:57-67 SKILL.md:67-75 SKILL.md:75-80 SKILL.md:80-84 SKILL.md:85-91 SKILL.md:91-92 SKILL.md:92-93 SKILL.md:93 SKILL.md:95 SKILL.md:97-104 SKILL.md:104-109 SKILL.md:109-118 SKILL.md:118-120 SKILL.md:120 SKILL.md:121-123 SKILL.md:123-126 SKILL.md:126 SKILL.md:127 SKILL.md:128 SKILL.md:129 SKILL.md:130 SKILL.md:136-140 SKILL.md:140-144 SKILL.md:144-148 SKILL.md:148-150 SKILL.md:150 SKILL.md:163-166 SKILL.md:166-170 SKILL.md:170-176 SKILL.md:176-178 SKILL.md:178-180 SKILL.md:180-183 SKILL.md:183-188 SKILL.md:188-195 SKILL.md:195-199
📁 文件系统访问 (13)
scripts/bambu_lan_print.py:24 scripts/bambu_lan_print.py:356 scripts/bambu_lan_print.py:727 scripts/bambu_lan_print.py:794 scripts/bambu_lan_print.py:1488 scripts/bambu_lan_print.py:1495 scripts/bambu_lan_print.py:26 scripts/bambu_lan_print.py:256 scripts/bambu_lan_print.py:257 scripts/bambu_lan_print.py:638 scripts/bambu_lan_print.py:639 SKILL.md:100 SKILL.md:112
审计者: codex