“And I’ve got back connections from hundreds of thousands of devices, with peaks of 200-300K concurrent clients.”
cups-browsed listens on UDP 631 on every interface and trusts packets from anyone. The package ships in most Linux distributions, some BSDs, ChromeOS and Solaris. The research took two days, and getting maintainers and CERT to act took 22. The exploit report still leaked to a breach forum before disclosure.