Have you ever had to send documents by fax? Many people in 2026 believe faxes are inherently more secure by default than emails. Phone lines are separate from the internet after all. However, fax machines in 2026 still have vulnerabilities that need to be addressed.
What is Faxploit?
At DEF CON 26 held in 2018, Check Point Research demonstrated they could exploit a traditional fax system (an HP OfficeJet Pro all-in-one printer) with only the fax number of the target machine. They sent an image file with embedded malicious code to the fax machine, which was decoded and executed by the machine, giving them control. From there, they were able to move laterally into a corporate network that the fax machine was on. The corporate network was not accessible by the internet.
Despite the corporate network being isolated from the internet (known as air-gapping) it was still vulnerable because the attacker could bypass via their connection to the fax machine.
How can you mitigate Faxploit?
“I won’t use phone lines and instead will encrypt and send my faxes over the internet”, you might say. Modern fax machines often transmit over the internet in addition to traditional phone lines. Many modern fax machines use UDP or T.38 protocols. These protocols do not encrypt any data unless IP-security controls like IPSec or AES are used. Anyone who can access the network can view the traffic unless steps are taken to protect it.
Another important consideration is making sure the firmware on your fax machine is up to date. The latest firmware patches for fax machines mitigate the risk of Faxploit.
And if you would rather not deal with it yourself, cloud-based fax services exist. An online fax service can offer encryption, MFA, audit trails, and patching as well as complying with HIPAA.
If you plan to send confidential information by fax, take steps to reduce your attack surface by considering the mitigations mentioned above.
As always, NGT is here to help!
If you have questions about protecting your organization from password spray attacks, contact ngthelp.com.