Prusa Firmware Security: 14 Findings, Update Before December
Prusa disclosed 14 findings affecting named Buddy-firmware printers running versions below 7.0.0. It recommends 8.0.0 or newer before exploit code planned for December; XL and MINI downloads list 8.0.1. One physical-access EEPROM defect remains partly fixed, with differing severity ratings. Check the bulletin’s exact model list; unnamed models are not established as affected or safe.
14 findings, fixed since 7.0.0, with one EEPROM defect still open
Prusa says all 14 findings are fixed in 7.0.0 and later, including 8.0.0, except one EEPROM defect that is only partly fixed.
A Prusa Connect buffer overflow let code run on the main controller, but only when the printer talked to a Connect server the attacker controlled or one without TLS, according to Prusa.
The researcher’s write-ups for all 14 findings went public on November 2, and he plans to release working proof-of-concept code “most probably in December”.
ReportPrusa Research
Which printers and firmware the bulletin covers
On November 2, Prusa Research and Prusa Development published security bulletin PSA-2026-002 for Buddy firmware older than 7.0.0. It covers 14 findings, about 23 individual defects, that independent security researcher Yannick Dixken reported in August after finding them on his own MK4S, and it lists 15 affected printers: the CORE One L+, CORE One L, CORE One+ (Gen 2) INDX, CORE One INDX, CORE One+ (Gen 2), CORE One, XL+, XL, MK4S, MK4, MK3.9S, MK3.9, MK3.5S, MK3.5 and MINI. Prusa says every finding is fixed in 7.0.0 and all later versions, including 8.0.0, except one EEPROM defect that is only partly fixed. The highest severity is High, a preliminary CVSS 3.1 base score of 8.1 for a Prusa Connect buffer overflow (PFB-008) that let code run on the printer’s main controller, but only when the printer talked to a Connect server under the attacker’s control or one without TLS, according to Prusa. Prusa says none of the issues can be used to attack a printer directly from the internet, none gives access to Prusa Accounts, passwords or payment data, and it is not aware of any use against customers. It adds that in that scenario the attacker “might also be able to read the Wi-Fi password and Connect token stored in the printer, or use the printer to reach other devices on the network. This was not demonstrated and would be hard to do.”
Prusa rates the practical risk low for most printers. In its table the only medium-risk setup is a printer pointed at a custom Connect server without TLS, which an owner would have set up on purpose. The deadline is real anyway: the researcher’s write-ups for all 14 findings went public with the bulletin on November 2, and he says he will release working proof-of-concept code “most probably in December”, which is why Prusa asks owners to update before then. Prusa is also candid about the release itself. It shipped 7.0.0 and 8.0.0 without publishing their source code at the same time, to give owners time to update, and now says “That was the wrong call”; it commits to same-day source code for every firmware release, a working security contact and public bulletins for every security fix. The Crafty Catsman does not own an affected Prusa printer and has not run firmware 7.0 or 8.0, so every rating here is Prusa’s or the researcher’s, as attributed.
Who is exposed, what is fixed and what Prusa changed
To demonstrate the most serious bug, the researcher chained PFB-008 with PFB-012, a network-stack flaw that lets another host on the network make PrusaLink, Connect and mDNS stop responding; his printer was set up to talk to his own Connect server and he was on the same local network. Prusa says the other findings range from crashes caused by crafted USB drives or files to defects that need physical changes inside the printer. The one defect still open is PFB-011, in the MMU protocol and EEPROM journal: Prusa rates it 3.5 Low and notes the researcher rates its EEPROM part up to 6.4; it needs physical access and opening the printer, and Prusa says it is reviewing it. An old Connect download path without an integrity check on print files (PFB-002) is gone from 7.0.0, and Prusa adds that firmware updates are signed and verified and are not affected. The bulletin’s severity scores are preliminary CVSS 3.1 ratings, some stated by the researcher and some Prusa’s internal estimates, and CVE IDs have not been assigned yet; Prusa says it will add them once they are.
What to install, and what else 8.0 changes: Prusa’s download pages list 8.0.1 (November 3) as the newest firmware for the XL/XL+, where it stops the fan test failing on a print fan spinning faster than 7000 RPM, and for the MINI/MINI+, where it fixes nozzle temperature swings and thermal runaway errors; every other affected printer’s newest download is 8.0.0 (October 22). Prusa’s 8.0.0 notes add a new M204 F filament acceleration limit, enabled by default, send per-tool data, consumed filament weight, loaded material and spool weight to Prusa Connect, and remove the printer hash from error screens; on the CORE One and CORE One L they also add OpenPrintTag support for NFC-tagged spools and filament UUIDs. Site analysis, not a measurement: because the acceleration limit is on by default, compare a familiar print after updating before you start a long job. The MK3S+ and MK3 are not in the bulletin’s affected list; they run separate 3.x firmware, and 3.14.1 is the newest on Prusa’s download pages. Prusa’s Help Center files the Signature Oak under the CORE One family, and its download page lists the same 6.8.1 record as the CORE One; the bulletin does not name it, so the site states neither that the Oak is affected nor that it is safe.
- When CVE IDs will be assigned; the researcher has requested them and Prusa says it will add them to the bulletin.
- When the partly fixed EEPROM defect (PFB-011) will be fully fixed; Prusa says it is reviewing it.
- Whether the proof-of-concept release lands in December; the researcher says “most probably in December”.
- Whether the Signature Oak is affected and how to update it; the bulletin does not name it, and its download page still lists 6.8.1 from August 14.
- Which firmware the CORE One L+ INDX should run; the bulletin does not name it and Prusa’s download pages show no separate list for it.
- Whether Prusa will ship an 8.0.x point release for the MK4, MK3.9, MK3.5 and CORE One printers, whose newest download is 8.0.0.
Ask Prusa support first if:You own a Signature Oak or a CORE One L+ INDX, which the bulletin does not name, or you rolled back to 6.x because of a 7.x problem and it is still there after trying the latest version.
Update now if:You run an MK4, MK4S, MK3.9, MK3.9S, MK3.5, MK3.5S, MINI, MINI+, XL, XL+ or a CORE One model named in the bulletin on firmware older than 7.0.0: install 8.0.1 on the XL/XL+ or MINI/MINI+ and 8.0.0 on the others.
PSA-2026-002 — what Prusa’s bulletin says
| Detail | Prusa Research Security bulletin PSA-2026-002 |
|---|---|
| Published | November 2, 2026, by Prusa Research and Prusa Development |
| Reported by | Independent researcher Yannick M. Dixken: 14 findings, about 23 defects |
| Affected | CORE One L+, CORE One L, CORE One+ (Gen 2) INDX, CORE One INDX, CORE One+ (Gen 2), CORE One, XL+, XL, MK4S, MK4, MK3.9S, MK3.9, MK3.5S, MK3.5 and MINI on Buddy firmware older than 7.0.0 |
| Fixed in | 7.0.0 and all later versions, including 8.0.0 |
| Still open | PFB-011, one EEPROM defect only partly fixed: Prusa rates it 3.5 Low and notes the researcher rates its EEPROM part up to 6.4; it needs physical access and opening the printer |
| Highest severity | High: preliminary CVSS 3.1 base score 8.1 (PFB-008), the researcher’s score |
| CVE IDs | Requested by the researcher; not yet assigned |
| 7.0.0 with the fixes | October 5 (CORE One and CORE One L); October 15 (all affected printers) |
| 8.0.0 | October 22, 2026 |
| Proof-of-concept code | Planned by the researcher for December 2026 |
Sources: Prusa security bulletin PSA-2026-002
Install the newest firmware Prusa lists for your printer now.
Install 8.0.1 on the XL/XL+ or MINI/MINI+ and 8.0.0 on the other affected printers. Any version from 7.0.0 up carries the fixes; until you update, Prusa advises keeping the printer on a trusted network with TLS on for Prusa Connect and not exposing it to the internet.
Prusa asks anyone who went back to 6.x because of a 7.x problem to try the latest version and to contact support if the problem is still there. The bulletin does not name the Signature Oak; ask Prusa support before updating it.
The researcher reaches Prusa
Prusa’s timeline says Yannick Dixken posted a short demo video on Reddit; its community manager contacted him within minutes, and he took the post down and emailed Prusa.
Prusa receives the full report
Prusa confirmed the right channel and received the full report package: write-ups, proof-of-concept code and crash dumps from his own MK4S.
Prusa confirms the findings
Prusa says it reproduced and confirmed the findings.
Firmware 7.0.0 for the CORE One and CORE One L
Firmware 7.0.0 with the fixes reached the CORE One and CORE One L first; Prusa’s CORE One+ notes for that release also add HT hotend support.
Firmware 7.0.0 for all affected printers
Prusa released 7.0.0 for all affected printers, including the CORE One INDX, which received 7.0.1 on October 19.
Firmware 8.0.0
Firmware 8.0.0 arrived for every affected printer, with a new filament acceleration limit enabled by default.
Bulletin, source code and write-up published together
Prusa published the bulletin and the firmware source code, and the researcher published his write-up, the same day; Prusa now calls releasing 7.0.0 and 8.0.0 without same-day source code “the wrong call”.
Firmware 8.0.1 for the XL and MINI
8.0.1 fixes a fan-test failure on the XL/XL+ and nozzle temperature swings and thermal runaway errors on the MINI/MINI+.
Primary pages and records used for this report.
Frequently Asked Questions
Is my Prusa printer at risk if it uses Prusa Connect at home?▼
Prusa rates that setup low risk before the update: the printer checks Prusa Connect’s certificate, so intercepting its traffic is not enough, and an attacker would have to take over Prusa’s servers or change your printer’s settings to point at their own server. Prusa’s one medium-risk case is a printer pointed at a custom Connect server without TLS. It still asks every owner to update to 8.0.0 or newer before the researcher publishes proof-of-concept code, which he plans for December 2026.
Which Prusa firmware version should I install?▼
Prusa’s download pages list 8.0.1 (November 3) for the XL, XL+, MINI and MINI+, and 8.0.0 (October 22) for the MK4, MK4S, MK3.9, MK3.9S, MK3.5, MK3.5S, CORE One, CORE One+, CORE One L, CORE One L+ and CORE One INDX. Prusa says any version from 7.0.0 contains the security fixes, and its first step is to update through Prusa Connect, PrusaLink or a USB drive using the files on its download pages. If you went back to 6.x because of a 7.x problem, it asks you to try the latest version and to contact support if the problem is still there, rather than stay on 6.x.
Have a launch, correction, or test opportunity?
Brands, product teams, and knowledgeable sources can send relevant details, approved media, or corrections. Coverage is selected independently.
Choose the useful next step.
Check the related Prusa records before you plan the update on each printer.
Get the next useful 3D printing update.
When a source-backed change affects what to buy, update, test, or ignore, we send a short decision brief with the evidence, the workshop consequence, and what remains unknown.
Know what changed. Know what it means at the bench. Decide whether to act, wait, update, test, or ignore.
Scanned daily. Sent only when the signal changes a workshop decision, with a rare alert when waiting would matter.
See how The Workshop Signal works