What we are seeing
A large multifunction printer is a computer with a hard disk, a web server, an address book and, very often, stored credentials for a mailbox and a file share. Somebody once forwarded a port to it so that scan-to-email would work from a second office, or so the supplier could read the meter. Nobody wrote it down.
From the outside it looks like a login page with the manufacturer's logo on it. The default password is in the manual, and the manual is on the internet.
Why it matters more than it sounds
- The address book is a verified list of real staff addresses, ideal for phishing
- Scan-to-email credentials are often a real mailbox with a password that never expires
- Scan-to-folder credentials are sometimes a domain account, occasionally an administrator
- The disk keeps copies of what was scanned. Payroll. Passports. Contracts.
What to do this week
- Look from the outside. Ask whoever manages your firewall for the list of port forwards. If nobody can produce one, that is the finding.
- Remove the forward. There is no good reason for a printer to accept connections from the internet. Supplier meter readings work outbound.
- Change the admin password and update the firmware while you are there.
- Replace stored credentials with an account that can do exactly one thing.
Returning a leased machine?
Ask for the disk to be wiped or removed, and get that in writing. Lease returns are resold with their contents more often than the industry likes to admit.