Raise3D Pro2 printers leak filesystem via debug port
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Authentication bypass in Raise3D Pro2 3D printers allows unauthenticated filesystem access when developer mode is enabled.
Raise3D Pro2 Series 3D printers contain an authentication bypass vulnerability (CVE-2025-10653) affecting all firmware versions. An unauthenticated debug port accessible over the network allows direct access to the device filesystem when developer mode is enabled, potentially enabling data exfiltration and device compromise. The vulnerability carries a CVSS v4 score of 8.8 (high severity) with network-based remote exploitation and low attack complexity. No public exploitation has been reported to CISA to date.
Raise3D has confirmed the vulnerability exists when developer mode is active and is developing a patched firmware version, though no release timeline has been provided. The vendor recommends disabling developer mode if not required. The devices are deployed worldwide in critical manufacturing environments. Defenders should immediately audit Pro2 printers for developer mode status, restrict network access to these devices, and isolate them from the internet and business networks where possible.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-275-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs