Skip to main content
protocols.pageprotocols.page
631

Port 631 – IPP / CUPS

TCP

Port 631 is the IPP (Internet Printing Protocol) port used by CUPS on Linux/macOS for print management. IPP runs over HTTP and supports authentication, encryption (IPPS), job accounting, and printer capability discovery. The CUPS web admin interface also listens on port 631 – restrict access to localhost.

Port Number

631

Protocol

TCP

Service

Internet Printing Protocol

Range

IANA Well-Known (0–1023)

Description

Internet Printing Protocol on port 631 is the modern standard for network printing. CUPS (Common Unix Printing System) on Linux and macOS uses IPP for all print operations. IPP runs as HTTP POST requests, making it firewall-friendly and capable of traversing proxies. The CUPS administration web interface on port 631 allows adding printers, managing queues, and viewing logs. By default it listens on localhost only. Exposing the CUPS web interface externally has led to remote code execution vulnerabilities (CVE-2024-47176 and related CUPS RCE chain). Always verify CUPS binds to 127.0.0.1 only, unless you specifically need network printing.

Security risks

  • 1CVE-2024-47176 + CVE-2024-47076 + CVE-2024-47175 + CVE-2024-47177 (CUPS RCE chain): unauthenticated attacker can exploit cups-browsed to add a malicious printer that executes arbitrary commands when a user prints to it (disclosed Sept 2024, affects most Linux distros)
  • 2CUPS web interface (localhost:631) allows printer administration – if exposed beyond localhost, attackers add malicious printers, modify existing ones, or read print job history
  • 3cups-browsed service auto-discovers printers via DNS-SD/mDNS – on networks with rogue devices, this automatically trusts and adds attacker-controlled print queues
  • 4Print job data exposure: CUPS stores completed jobs in /var/spool/cups/ – sensitive documents (HR, legal, financial) persist on disk unless job history is disabled
  • 5IPP protocol information disclosure: IPP Get-Printer-Attributes reveals OS version, CUPS version, physical location, and DNS name to any querying client

Firewall guidance

Bind CUPS to localhost only (cupsd.conf: Listen localhost:631). Disable cups-browsed if automatic printer discovery is not needed (systemctl disable cups-browsed). If network printing is required: configure explicit printers, don't rely on auto-discovery. macOS: printer sharing uses port 631 – disable if not intentionally sharing. Never expose port 631 to the internet.

Diagnosis commands

Check CUPS listening address and browse protocols (should be localhost, no DNSSD)

shell
cupsctl | grep -E 'BrowseLocalProtocols|Listen'

Full CUPS status: printers, classes, jobs, and configuration

shell
lpstat -t

Check if cups-browsed is running (disable if not needed)

shell
systemctl status cups-browsed

List configured printers via CUPS web interface

shell
curl -s http://localhost:631/printers/ | grep -o 'printer/[^"]*' | sort -u

Usage examples

Port 631 – IPP / CUPS
shell
lpstat -p
cupsctl --remote-admin
ipptool -tv ipp://printer:631 get-printer-attributes.test
curl http://localhost:631/printers/

Common services on this port

CUPS (Linux/macOS)cups-browsedIPP printers (HP, Epson, Canon, Brother)AirPrint (uses IPP)

Related ports

631

IPP/CUPS (this port)

515

LPD (legacy Unix printing)

9100

JetDirect/AppSocket (raw TCP)

443

IPPS (IPP over TLS)

History

IPP (Internet Printing Protocol) was standardized in RFC 2910/2911 (2000) by the Printer Working Group. CUPS (Common Unix Printing System, created by Michael Sweet in 1999) adopted IPP on port 631 and became the default print system for Linux and macOS. Apple hired Michael Sweet in 2007; macOS uses CUPS natively. The September 2024 CUPS RCE chain (CVE-2024-47176 et al.) renewed attention to the attack surface of cups-browsed's auto-discovery.

FAQ

How do I mitigate the 2024 CUPS RCE vulnerabilities?

Immediate: systemctl disable --now cups-browsed (this disables the vulnerable auto-discovery). If cups-browsed is needed: edit /etc/cups/cups-browsed.conf and set BrowseRemoteProtocols none (disables network printer discovery). Long-term: update to patched CUPS packages when your distro releases them. The vulnerability requires cups-browsed running + attacker reaching UDP port 631.

Is it safe to share a printer via CUPS on my LAN?

Only if: (1) cups-browsed is disabled or restricted, (2) CUPS admin interface is bound to localhost (Listen localhost:631), (3) sharing is restricted to specific subnets (cupsd.conf: Allow from 192.168.1.0/24), (4) authentication is required for admin operations. AirPrint (Apple devices) uses mDNS to discover IPP printers on port 631 – this is safe on a trusted LAN but exposes the printer to every device on the same subnet.

Specification

RFC 8011 – Port 631 specification →