Port 9100 – JetDirect / AppSocket (Raw Print / PDL Data Stream)

Port 9100 is the raw print / JetDirect / AppSocket port (also called PDL-datastream) — the plain TCP socket that almost every network printer listens on. Whatever you write to the socket is fed directly to the print engine with no protocol negotiation, no spooler, and, by default, no authentication. That “just pipe bytes at it” design is exactly why 9100 is the printer-hacking port: instead of a print job you can send PJL (Printer Job Language), PostScript, or PCL commands and make the printer do things it was never meant to expose — read and rewrite its own configuration and NVRAM, change the front-panel display, capture other people’s print jobs, browse the on-device filesystem, or hand over the credentials it stored to “scan-to-email” and “scan-to-folder”. HP’s JetDirect print servers popularised 9100 and virtually every other vendor cloned the behaviour, so an open port 9100 is one of the highest-value, lowest-effort footholds on an internal network.

Why It’s Open

Port 9100 is open because it is the default raw-printing port on essentially all network-capable printers and multifunction devices (MFPs), and on the external print servers that front older USB printers. Windows calls it a “Standard TCP/IP Port” in RAW mode; macOS, CUPS, and Linux all support “socket://host:9100” printing; HP branded it JetDirect and the industry adopted AppSocket / PDL-datastream as generic names for the same thing.

It stays open for a few reasons:

• It’s the path of least resistance for printing. Raw 9100 needs no queue configuration on the printer side — the client just opens a TCP connection and streams the job. Print servers and MFPs enable it out of the box.
• Management tooling expects it. Fleet-management and driver-install wizards frequently probe and use 9100, so admins leave it on.
• Nobody re-images a printer. Printers get racked and forgotten. The service that shipped enabled years ago is still enabled, still unauthenticated, and often still running firmware from the same era.

The “metrics” framing some inventories attach to 9100 is misleading: 9100 itself is a raw print channel, not a telemetry protocol. Printer metrics and status are pulled over SNMP on port 161 or a vendor web UI — 9100 is where the actual attack surface lives.

Common Risks

• No authentication by design. The raw-print socket has no login. Anyone who can reach 9100 can submit jobs and, on most devices, issue PJL/PostScript control commands. This is a design property of the protocol, not a single patchable bug.
• PJL configuration & NVRAM tampering. @PJL commands can read (DINQUIRE/INQUIRE) and set (SET, DEFAULT) environment and NVRAM variables — changing timeouts, disabling security features, resetting settings, or persisting attacker-chosen values across reboots.
• Job capture / print retention. By flipping PJL/PostScript variables an attacker can force the printer to retain or duplicate every job that passes through it, then retrieve other users’ documents — an ideal data-exfiltration channel for anything sensitive that gets printed.
• Display and denial-of-service abuse. @PJL RDYMSG DISPLAY rewrites the front-panel message (classic “printer ransom” / graffiti), and malformed PDL, offline commands, or repeated NVRAM writes can wedge the device or physically wear the NVRAM until it bricks.
• Printer filesystem access. PJL file commands (FSDIRLIST, FSUPLOAD, FSDOWNLOAD) expose the on-device filesystem — read spooled data and config, or write files. On some HP devices this reaches outside the sandbox and becomes remote code execution (see CVE-2017-2741 below).
• Pivot / SSRF / credential harvesting. MFPs store cleartext or trivially-reversible credentials for LDAP, SMB “scan-to-folder”, SMTP, and FTP so they can authenticate to the network on the user’s behalf. A compromised printer is an unmonitored Linux/VxWorks box that can reach internal services, be pointed at attacker-controlled endpoints to leak those stored credentials, and generally acts as a foothold no EDR is watching.
• Legacy firmware, real CVEs. Because printers are rarely patched, published printer/PJL vulnerabilities stay exploitable for years.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

Book a Demo

Enumeration & Testing

The plan on port 9100 is: confirm it’s a raw-print/JetDirect socket, fingerprint the device with PJL, then decide whether design-level PJL/PostScript abuse or a device-specific CVE applies. The canonical toolkit here is PRET (the Printer Exploitation Toolkit) from Ruhr-University Bochum, which wraps the PJL/PostScript/PCL attack classes documented in their “Hacking Printers” research.

Detect the service and version

nmap -sV -p 9100 <target>

PJL fingerprint with Nmap’s NSE script

pjl-ready-message.nse speaks PJL to the device: with no argument it reads the current front-panel “ready” message, and with an argument it changes it (proof you can control the display).

# Read the current display message
nmap --script pjl-ready-message -p 9100 <target>

# Set it (demonstrates unauthenticated control)
nmap --script pjl-ready-message --script-args pjl_ready_message="TESTING" -p 9100 <target>

Raw PJL banner grab with netcat

Ask the printer to identify itself. @PJL INFO ID returns the model; INFO STATUS/INFO CONFIG return status and capabilities.

printf '@PJL INFO ID\r\n' | nc <target> 9100
printf '@PJL INFO CONFIG\r\n' | nc <target> 9100

Drive the printer with PRET

PRET connects to 9100 and gives an interactive shell for the chosen language — pjl, ps (PostScript), or pcl:

git clone https://github.com/RUB-NDS/PRET && cd PRET
python3 pret.py <target> pjl
# inside the PRET shell:
#   id                  # printer model            (@PJL INFO ID)
#   info config         # dump full configuration
#   nvram dump          # read NVRAM (may expose stored creds/settings)
#   display "PWNED"     # rewrite the LCD panel     (@PJL RDYMSG DISPLAY)
#   ls  /  cat <file>   # browse the printer filesystem (FSDIRLIST/FSUPLOAD)
#   capture start       # begin capturing other users' print jobs

Submit a raw print job

Anything streamed to the socket prints — useful to prove unauthenticated submission:

cat job.ps | nc <target> 9100

Exploit HP JetDirect path traversal (CVE-2017-2741)

For vulnerable HP PageWide / OfficeJet Pro devices, Metasploit turns the PJL filesystem access into code execution:

msfconsole -q
use exploit/linux/misc/hp_jetdirect_path_traversal
set RHOSTS <target>
run

Record every open port 9100, the exact printer model and firmware, any config or credentials you pull, and whether you could change the display or capture jobs, so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.

What to Look For

Known CVEs and Exploits

The most important thing to say honestly about port 9100 is that its biggest problem is not a CVE at all — it is a design decision. PJL, PostScript, and PCL commands sent over the raw-print socket are unauthenticated by design, so job capture, NVRAM/config tampering, display abuse, and filesystem access work on huge numbers of “unpatched-because-there’s-nothing-to-patch” printers. These attack classes are catalogued in the “Hacking Printers” research and wiki from Ruhr-University Bochum and are automated by their PRET toolkit. Treat 9100 as an unauthenticated remote-control interface first, and hunt for device-specific CVEs second.

Verified device CVEs that are genuinely reachable through this surface:

• CVE-2017-2741 — Path traversal on HP PageWide and OfficeJet Pro printers (firmware before 1708D). PJL filesystem access on port 9100 escapes the intended sandbox, letting an unauthenticated attacker write a shell script into a startup directory (/etc/profile.d) and trigger it via a reboot — arbitrary code execution, CVSS 9.8. This is Tenable’s “Rooting a Printer” research. Weaponised as Metasploit exploit/linux/misc/hp_jetdirect_path_traversal (default RPORT 9100) and archived as Exploit-DB 45273.
• CVE-2017-2750 — HP LaserJet Enterprise, PageWide Enterprise, LaserJet Managed, and OfficeJet Enterprise printers: insufficient solution-DLL signature validation allowing execution of arbitrary code, CVSS 9.8. It is part of the same HP printer-firmware advisory family, though the vector is an unsigned “solution” package rather than the 9100 raw socket itself.
• CVE-2021-39237 — Certain HP LaserJet, LaserJet Managed, PageWide, and PageWide Managed printers (FutureSmart firmware): an information-disclosure flaw that can expose sensitive data from the device. A reminder that even “just a printer” leaks.

An older HP JetDirect PJL directory-traversal file read is also archived as Exploit-DB 17635.

CVEs removed from the previous version of this page (they were mislabeled or wrong-service):

• CVE-2023-27350 was cited as generic “print infrastructure.” It is actually a PaperCut MF/NG authentication-bypass RCE in a print-management web application (its own web ports), not the raw 9100 JetDirect service — removed.
• CVE-2021-3438 was cited as a “printing subsystem” bug. It is actually a local buffer overflow in the Windows print driver (SSPORT.SYS) for some HP LaserJet and Samsung printers, a local privilege-escalation issue with nothing to do with the network 9100 port — removed.
• The old page labeled CVE-2017-2750 as “PJL directory traversal / information disclosure” (that is really CVE-2017-2741’s behaviour) and CVE-2021-39237 as a “PrinterLogic Web Stack” bug (it is actually HP LaserJet firmware). Both descriptions were corrected above. Always verify a CVE’s product and mechanism on NVD before trusting a stub’s summary.

Mitigation

• Restrict who can reach 9100. Allow the raw-print port only from your print servers or a tightly-scoped print VLAN, and never expose it to the internet. Firewall/ACL is the single highest-impact control because the protocol itself has no auth to fall back on.
• Prefer authenticated, encrypted printing. Where the fleet supports it, move users to IPP over TLS on port 631 (IPPS) with authentication, and disable raw 9100 (and legacy LPD on port 515) if nothing needs them.
• Disable PJL/PostScript control features you don’t use. Many enterprise printers can lock the control panel, disable PJL device-access commands, disable the PostScript/PJL filesystem, and set a PJL password — turn those on.
• Purge and protect stored credentials. Review “scan-to-email/folder”, LDAP, and SMTP settings; use scoped service accounts with least privilege, not domain admin, so a dumped credential is worth little.
• Patch firmware. Keep printer firmware current — CVE-2017-2741 and the other HP advisories are fixed in firmware. Printers belong in the patch program, not outside it.
• Segment and monitor. Put printers in an isolated VLAN with limited east-west access, poll them over authenticated SNMPv3 on port 161 rather than SNMP v1/v2c, and alert on unexpected 9100 clients, display changes, or spikes in job volume.

Real-World Example

The cleanest demonstration of why 9100 is dangerous is Tenable’s “Rooting a Printer” work behind CVE-2017-2741. Researchers found that HP PageWide and OfficeJet Pro devices let a PJL filesystem request on port 9100 traverse outside its intended directory. Because the printer runs a real operating system, they wrote a small shell script into a startup path (/etc/profile.d), then rebooted the device so it executed on boot — turning an “unauthenticated print job” into remote code execution on the printer, with no credentials required. Metasploit shipped it as exploit/linux/misc/hp_jetdirect_path_traversal.

The broader, non-CVE reality is even more common and predates it: in 2018 an attacker calling themselves “TheHackerGiraffe” scanned the internet for exposed 9100, found tens of thousands of reachable printers, and used PRET-style PJL to make them all print a message — a benign prank that could just as easily have been NVRAM wipes, job capture, or credential theft. Both cases hammer the same point: the raw-print socket is an unauthenticated remote-control interface, and the only thing standing between an attacker and the printers (and the network behind them) is whether 9100 is reachable.

FAQ

What is port 9100 used for?

Port 9100 is the raw TCP printing port — variously called JetDirect, AppSocket, or PDL-datastream. Clients open a socket and stream a print job (PostScript, PCL) or PJL commands straight to the printer with no protocol negotiation. HP popularised it via JetDirect print servers, and almost every network printer and multifunction device now listens on it by default.

Why is port 9100 open on my printer or network?

Because raw printing is enabled out of the box on essentially all network printers and print servers, and Windows/macOS/CUPS all support “socket://host:9100” printing. It’s the simplest way to print, so vendors ship it on and admins leave it on. An open 9100 usually just means a printer is present — the concern is that it’s reachable from somewhere it shouldn’t be.

Is port 9100 dangerous?

The port is fine on an isolated print network; the danger is that the protocol has no authentication. Anyone who can reach 9100 can submit jobs and, on most devices, run PJL/PostScript commands to read the config and NVRAM, change the display, capture other people’s print jobs, browse the filesystem, and pull stored LDAP/SMB/SMTP credentials — using the printer as a foothold. It should never be exposed to untrusted networks or the internet.

How do I test what’s running on port 9100?

Confirm the service with nmap -sV -p 9100 <host>, fingerprint the device over PJL with nmap --script pjl-ready-message -p 9100 <host> or printf '@PJL INFO ID\r\n' | nc <host> 9100, and drive the full PJL/PostScript/PCL attack surface with PRET (python3 pret.py <host> pjl). For vulnerable HP devices, Metasploit’s exploit/linux/misc/hp_jetdirect_path_traversal demonstrates CVE-2017-2741.

What are PRET and PJL?

PJL (Printer Job Language) is HP’s out-of-band control language for printers — it sets job options, reads/writes device variables and NVRAM, controls the display, and (on many devices) accesses a filesystem, all unauthenticated over 9100. PRET (Printer Exploitation Toolkit) is an open-source tool from Ruhr-University Bochum that automates PJL, PostScript, and PCL attacks — job capture, config/NVRAM manipulation, filesystem access, and DoS — from an interactive shell.

How do I secure or close port 9100?

Firewall 9100 to your print servers or a dedicated print VLAN and never expose it externally; disable raw printing and move to authenticated IPPS on 631 where possible; turn on the printer’s control-panel lock, PJL password, and “disable PJL device access / filesystem” options; use least-privilege service accounts for scan-to features; keep firmware patched; and monitor for unexpected clients and display changes. Rescan with nmap -p 9100 <host> to confirm the change.

TL;DR

• Service: raw TCP printing — JetDirect / AppSocket / PDL-datastream (HP JetDirect and equivalents), speaking PostScript, PCL, and PJL
• Default port: 9100/TCP (printer status/metrics live on SNMP 161, not here)
• Biggest risk: unauthenticated by design — PJL/PostScript over 9100 lets anyone reachable read/rewrite config and NVRAM, change the display, capture print jobs, browse the filesystem, and harvest stored LDAP/SMB/SMTP credentials to pivot; CVE-2017-2741 escalates HP JetDirect PJL filesystem access to RCE
• Mitigation: firewall 9100 to print servers/VLAN only, disable raw printing in favour of authenticated IPPS, turn off PJL device-access/filesystem and set a PJL password, patch firmware, and use least-privilege scan-to accounts