At 4:12 p.m. on a Thursday, the practice administrator at a 22-provider orthopedic group fed 63 pages of prior-authorization paperwork into the hallway copier and pressed Scan to Folder. The job finished in 51 seconds. The PDF landed in the referrals share, where it always does.

In those 51 seconds the device authenticated to the domain twice. Once as the LDAP account it uses to populate the address book, and once as the account that writes to the file server. Both credentials are stored on the copier. Neither is in the password manager. Neither has rotated since installation. The device holding them has never received a firmware update, has no endpoint agent, appears in no patch report, and does not exist in the asset inventory — because it appears on a different spreadsheet, in the accounting system, as a lease.

"It's on the copier contract" is doing more work than it looks

That sentence is usually true and usually reasonable. Managed print genuinely works for what it was built to do. Dealers keep toner ahead of demand, hold uptime, absorb parts, and hit a cost-per-page number most internal teams could not match. The fleet-management model exists because organizations were bad at this and the dealers are good at it. None of this is a knock on your copier dealer.

But "the copier is on the vendor's contract" answers a procurement question, and everyone hears it as an answer to a security question. It is not. Ask two follow-ups and the seam opens: who holds the device's administrative password, and who applies its firmware on what schedule? In most offices the honest answers are "the dealer, probably" and "nobody has ever applied one."

The consequences are documented, recent, and specific.

  • The Xerox VersaLink pass-back attack, disclosed February 14, 2025. Rapid7's Deral Heiland found two flaws in a VersaLink C7025 running firmware 57.69.91 and earlier. CVE-2024-12510 lets someone with device admin access change the configured LDAP server to a host they control and trigger a lookup, which hands over the LDAP service credentials in clear text. CVE-2024-12511 does the same trick against a configured SMB or FTP scan destination, capturing NetNTLMv2 handshakes or clear-text FTP credentials. Xerox rated CVE-2024-12510 at CVSS 6.7 and shipped patches between January 29 and 31, 2025. The payoff for the attacker is Windows Active Directory credentials and lateral movement.
  • The Brother disclosure, June 25, 2025, reached 748 models across five manufacturers. Rapid7 counted 689 Brother models plus 46 FUJIFILM Business Innovation, six Konica Minolta, five Ricoh, and two Toshiba Tec. CVE-2024-51978, rated CVSS 9.8, lets an attacker generate the device's default administrative password from its serial number — and CVE-2024-51977 leaks that serial number to an unauthenticated remote attacker. CVE-2024-51984 discloses the plain-text credentials of configured external services such as LDAP or FTP. Brother stated the password flaw cannot be fully remediated in firmware and changed its manufacturing process for new devices.
  • This is not a 2025 phenomenon. NCC Group's 2019 Ricoh advisory covered ten CVEs on four models, including three unauthenticated remote code execution issues at CVSS 9.8 and hardcoded FTP credentials.

The pattern is consistent: the credential you gave the copier to make scanning convenient is the credential an attacker takes. Which reframes the design question.

How do you build scan-to-folder with no standing domain credentials?

You cannot get literally to zero on an SMB destination — something has to authenticate to the file server. What you can do is make the credential on the device worthless to steal. That is the actual goal, and it is achievable today.

A dedicated service account with a write-only share. Create one account per function, not one shared "scanner" account across the fleet. Give it a long random password stored in your vault. Deny it interactive logon and remote desktop logon by policy. Give it no mailbox, no group memberships beyond Domain Users, and no local admin anywhere. Then set the share and NTFS permissions so it can create files and write data but cannot list the directory, read existing files, or delete. What this protects against: the pass-back and relay attacks still capture the credential, but the credential buys the attacker the ability to drop a file into one folder — no enumeration of the share, no reading back everyone else's scans, no reuse anywhere. What it does not protect against: the attacker now has a valid domain identity for password spraying and directory reconnaissance, which is why the account should be monitored and its failed-logon pattern alerted on.

SMB signing, understood correctly. Signing adds a cryptographic signature carrying the identities of sender and intended recipient, so mismatches surface tampering. Microsoft describes it as protecting against relay and spoofing attacks and providing authentication that helps prevent adversary-in-the-middle attacks. Windows 11 version 24H2 (Enterprise, Pro, Education) now requires both inbound and outbound signing by default, and Windows Server 2025 requires outbound. Two honest caveats: signing is integrity and authentication, not encryption — SMB encryption is a separate control you should also enable on scan shares — and older MFPs frequently cannot sign, or speak only SMB1. When enforcement breaks a copier, that is a decision point about the copier, not a reason to disable the control.

Scan-to-email through a submission path, not a mailbox credential. The default a technician reaches for is a licensed mailbox with a username and password typed into the device's web interface. Microsoft documents three approaches, and that one is the worst of them. Client SMTP submission requires a licensed mailbox and credentials, caps at 30 messages per minute and 10,000 recipients per day, and its basic authentication path is being retired. Direct send requires no credentials at all — the device connects anonymously to your tenant's MX endpoint on port 25 — but can only deliver to recipients inside your organization. An SMTP relay via a dedicated inbound connector requires no mailbox and no password either, authenticating instead by certificate or by a static, unshared public IP, and it can reach external recipients. What this protects against: there is no credential on the device to pass back, so the entire class of scan-to-email credential theft disappears. The trade-off is real — direct send is internal-only, and a relay connector authenticated by IP is only as good as your control of that IP, which is why the certificate-based variant is preferable.

Scan-to-cloud, where the platform supports it. Modern devices can run an embedded app that authenticates the walk-up user to SharePoint, OneDrive, or Google Drive by OAuth at the panel. What this protects against: no Active Directory credential on the device, no SMB path stored in the address book, per-user attribution in the audit log, and revocation from your identity provider rather than a service call. The trade-offs: a token still resides on the device, the vendor's cloud sits in the data path and needs a review, and it usually costs a license.

What none of these fix: if you use directory lookup for the address book, an LDAP bind account still lives on the device. Scope it to read-only, restrict it to the OU it needs, and prefer LDAPS.

What the embedded web server gives away

Point a browser at an MFP's management address and note what is reachable before you authenticate. Typically: the internal address book, which is a directory of employee names, email addresses, and — worse — the UNC paths of your file shares, effectively a map of the file server; every stored SMB and FTP destination; the LDAP bind configuration; and, on devices with stored jobs, mailboxes, or held print, actual documents still sitting on the disk.

Penetration testers do not treat this as exotic. Published testing work notes that some devices store domain credentials for SMB and FTP scan destinations in a form that can be pulled directly with a Metasploit module, that management protocols including VNC, HTTP, and SNMP frequently run without authentication, and that the service accounts configured on MFPs are almost always over-privileged relative to what writing a PDF to a share requires.

The remediation is unglamorous. Change the administrative password and store it where your team can reach it. Require authentication on the embedded web server and use HTTPS with a real certificate. Disable protocols you do not use — FTP, Telnet, raw port 9100, SNMPv1 and v2c community strings. Put the fleet on its own VLAN with egress restricted to the file server, the mail path, and the vendor's endpoint, and nothing else.

Who patches the firmware when no agent touches it?

RMM platforms cover Windows, macOS, and Linux endpoints. An MFP accepts no agent, so it never appears as non-compliant, never fails a patch report, and never generates a ticket. Devices are patched when a technician happens to be on site for a paper jam and notices.

That gap matters because print infrastructure gets exploited in the real world, not only in labs. CISA added the PaperCut flaw CVE-2023-27350 — CVSS 9.8, exploitable without authentication — to its Known Exploited Vulnerabilities catalog on April 21, 2023, with a federal remediation deadline of May 12, 2023. The KEV catalog is evidence of active exploitation, not theory.

Fix it with a named cadence and a named owner. Quarterly firmware review for the fleet, with an out-of-band path for anything critical, and evidence that is a report listing each device serial and its running firmware version. The obstacle you will hit immediately is that applying firmware usually requires the device administrative password — which brings you back to who holds it.

What the vendor's collection agent reaches, and who approved it

Nearly every managed print arrangement installs a data collection agent on a machine inside your network. Published documentation for one long-established platform describes a Windows service that discovers and polls devices using SNMP and ICMP, optionally PJL, gathering page counts, device descriptions, and status; it transmits outbound over FTP on port 21, HTTP on port 80, or HTTPS on port 443 with SSL, communicating one way so no inbound firewall rules are required; and it states that no personal or user data is collected.

That is a reasonable design for a legitimate purpose — meter reads and toner forecasting. The governance question is not whether it is malware. It is:

  • Who installed it, on which host, and under what service account. In most offices it was a delivery technician during a copier install, and nobody in IT approved the account or its privileges.
  • What subnets does it sweep, and how often. An SNMP discovery agent walking your entire address space is doing network reconnaissance on a schedule. You should know the ranges.
  • Which transport is actually configured. FTP over port 21 and HTTP over port 80 are options in some products. Confirm it is on 443.
  • Whether it appears in your asset inventory and your vendor risk register. If a third party runs software on a domain-joined host, that vendor belongs on the list you review annually, alongside every other one.

The disk at end of lease

In August 2013, HHS settled with Affinity Health Plan for $1,215,780 over the protected health information of up to 344,579 individuals, disclosed when the organization returned multiple photocopiers to a leasing agent without erasing the data on the copier hard drives. OCR also found that Affinity had failed to include the electronic PHI on those drives in its risk analysis, and had no policies governing the return of the drives.

Every element of that case is still available to reproduce, because the sanitization decision is almost always made on a loading dock while a truck idles. Move it months earlier.

NIST SP 800-88 Rev. 1 gives you the vocabulary: Clear applies logical techniques through standard read and write commands; Purge applies techniques that render recovery infeasible using state-of-the-art laboratory methods; Destroy renders the media unusable. Media exchanged for warranty, rebate, or lease return that will not come back is out of organizational control and must be sanitized before it leaves. The guidance also expects a certificate of media disposition recording manufacturer, model, serial number, method, verification approach, and the personnel involved.

Practically: enable image overwrite and disk encryption on day one of the lease, not day one of the return. At return, either witness and document a purge with a certificate naming the serial number, or negotiate to buy the drive and destroy it yourself. Note that newer devices use eMMC or SSD storage where overwrite behaves unpredictably, which makes cryptographic erase the correct purge method — another reason encryption should be on from the beginning.

Two clauses worth inserting at renewal

Administrative credential ownership. The customer holds the device administrator password. The vendor receives a separate named service account with its own credential, its access is logged, and that account is removed within a defined number of days of termination or technician departure. This single clause is what makes everything else in this article possible — you cannot patch, audit, harden, or sanitize a device whose admin password lives only at the dealership.

Firmware maintenance responsibility with a named cadence. Specify who applies firmware, how fast for critical severity versus routine — 30 days from vendor release for critical and quarterly otherwise is a defensible pair of numbers — how compliance is evidenced, and who bears the cost. Absent a cadence, "the vendor maintains the device" means toner and rollers. Add the media disposition obligation and its certificate to the same section while the contract is open, because the return language usually sits in the lease's fine print and favors the leasing company.

The copier is not a printer. It is an unmanaged network appliance with a scanner, a disk, a directory credential, an address book of your file server paths, an embedded web server, and a vendor's agent somewhere on your network. Everything in that sentence belongs to you. At renewal, the only question that matters is whether the contract says so.