LOW
The severity is rated LOW as there are no known vulnerabilities associated with Thermoprint. However, users should be cautious about Bluetooth security and web application security best practices to prevent potential attacks.

The web app, Thermoprint, provides a user-friendly interface to control Marklife P12 and P15 thermal printers via Bluetooth. Developed as an alternative to the official application, it allows users to print directly from their browsers without installing software or creating accounts. Additionally, a command-line interface (CLI) is included for integration with AI agents such as OpenClaw, enabling automated printing tasks. While the app itself does not introduce any new security vulnerabilities, its reliance on Bluetooth and web technologies exposes potential attack vectors, including unauthorized access to printer functions via Bluetooth exploits or cross-site scripting (XSS) attacks within the web interface.

Affected Systems
  • Marklife P12 thermal printer
  • Marklife P15 thermal printer
Affected Versions: All versions
Remediation
  • Ensure Bluetooth is secure by disabling it when not in use or using a firewall to block unauthorized access.
  • Regularly update the browser and any other software used with Thermoprint to ensure security patches are applied.
  • Review the web app's source code and dependencies for potential vulnerabilities, especially if integrating with AI agents.
Stack Impact

Minimal direct impact on common homelab stacks. However, users should be aware of Bluetooth security risks and keep their browsers up-to-date to mitigate any potential XSS or other web-based attacks.

Source →