Shenzhen-based 3D printer manufacturer Bambu Lab has launched a new firmware for its X1 Series of 3D printers. The optional security update introduces authorization and authentication controls for key 3D printing operations, altering how third-party software interacts with the 3D printer.
Some in the 3D printing community have not received the news well, leading to Bambu Lab refuting claims that the firmware, currently undergoing beta testing, restricts third-party tools or forces users into a closed ecosystem. Those who choose not to install the update can continue using external software without any changes. The company has also introduced a new tool called Bambu Connect, designed to integrate third-party software with updated printers. Bambu Lab is collaborating with software developers, including Orca Slicer, to ensure a seamless connection with external tools.
According to the leading desktop 3D printing company, this new authorization and authentication protection mechanism will combat remote hackers and printer exposure issues. It will also help defend against abnormal traffic and cyberattacks, which have previously targeted Bambu Lab systems.
The earlier announcement has drawn vocal criticism from individuals who view it as an attack on open-source 3D printing. This philosophy was central to many desktop 3D printing pioneers and remains a core ethos within the community.
Nick Sonnentag, Founder and CEO of concrete 3D printing firm Sunnyday Technologies, called the move “a big disappointment for me because I view open-source as necessary for innovation from the larger community.” Josef Prusa, CEO of competing desktop 3D printer manufacturer Prusa Research, also responded on LinkedIn, stating it is “Quite scary where the 3DP industry is moving – control of your data.”
Amid this backlash, Bambu Lab has directly challenged what it calls “unfortunate misinformation circulating online.” In a blog post, it addressed “false accusations head-on,” countering “baseless allegations” about the update.
Bambu Lab announces new Firmware update
Once installed, the new firmware introduces authorization controls for key 3D printer operations. These include firmware upgrades, printer binding and unbinding, remote video access, 3D print job initiation via LAN or cloud mode, and control of key 3D printer parameters like temperature and AMS settings.
Actions not impacted by the new firmware include 3D printing from SD cards, sending status information updates, and other general operations outside the listed controls. Notably, users who continue with outdated firmware will still be able to use both old and future versions of the Bambu Studio slicer and Bambu Handy application.
The new Bambu Connect tool offers a pathway for those wanting to leverage third-party software alongside the new Firmware. It serves as a replacement for Bambu Lab’s API network plugin. According to the company, Bambu Connect has been designed as a streamlined tool with improved security protocols. The platform, now in beta mode, acts as a direct interface for third-party software. Bambu Lab has reportedly worked with third-party developers, including Orca Slicer, to ensure its workflow minimizes disruption to existing user processes.
Through Bambu Connect, external software can access printer functionality, while a new network plugin provides a secure interface for 3D printer control and monitoring. All printer commands pass through secured and verified channels. Significantly, LAN mode does not require internet access or a user account.
The tool is activated only when handling 3D printer communications, with users retaining full access to print progress updates, including live monitoring of temperatures, 3D print status, and parameters. Through Bambu Connect, users can manage print jobs, discover and connect to 3D printers in LAN mode, send sliced files for 3D printing, and access control features like axis movement. Third-party software can also be programmed to open Bambu Connect and import specific G-code or 3MF files for 3D printing.
Following feedback from 3D print farms, the Bambu Lab has added an optional LAN ‘Developer Mode.’ This allows users to manage their network setup by keeping MQTT channels, video live streams, and File Transfer Protocol (FTP) open.
Users wishing to access this must manually enable it on their 3D printer. Once selected, the operator assumes full responsibility for securing their local network. Additionally, customer support isn’t available for this mode, as the communication protocols are not officially supported.
All future Bambu Lab 3D printers are set to integrate the firmware’s authorization control technology as standard to ensure “the highest levels of user security and printer protection moving forward.”
Bambu Lab firmware update prompts backlash
For a vocal number in the desktop 3D printing community, Bambu Lab’s update goes against the inherent open-source principles that informed early 3D printing pioneers.
The community that coalesced around Dr. Adrian Bowyer’s RepRap project viewed open source as the key to democratizing 3D printing, making FDM technology accessible to anyone. Boweyer’s community-led project inspired the likes of Prusa Research, UltiMaker, and MakerBot. Many also believe that once a 3D printer has been purchased, users should be able to run and tweak their hardware as they please.
As such, Bambu Lab’s firmware update has been met with community criticism, with many sharing their displeasure on social media and online forums. Some have taken things further, with efforts to hack Bambu Connect and unlock open-source connectivity, reflecting even stronger opposition to the move. As reported by Hackaday, Reddit user hWuxH successfully extracted Bambu Connect’s X.509 certificate and private key, which prevent third-party software from communicating with authentication-protected 3D printers.
Sonnentage noted that the new firmware update is not compatible with Sunnyday’s 3rd-party job management software, preventing connectivity with the company’s other open-source machines. “This is no small problem,” added the CEO in a LinkedIn post. “The capability to remotely monitor and stop the print not only saves money in wasted material but potentially ruined equipment.”
Prusa also highlighted concerns regarding Bambu Lab’s relationship with Chinese investor IDG Capital. The firm, which names Bambu Lab in its investment portfolio, was previously included on the US Department of Defense’s list of companies with Chinese military ties. IDG was removed from the Pentagon’s list in December 2024.
Additionally, Prusa pointed to Article 7 of China’s National Intelligence Law, which instructs all organizations and citizens to “support, assist, and cooperate with national intelligence efforts in accordance with law, and shall protect national intelligence work secrets they are aware of.” He also questioned whether financial support from the Chinese government reflects more nefarious motivations. “Massive subsidies makes the situation even more spicy. China designated 3D printing industry as strategic. One has to think about the motives,” Prusa added. A potential reference to the Made in China 2025 Action Plan published in 2017.
Cyber security and manufacturing
After announcing its new firmware, Bambu Lab reported seeing a “mix of valuable feedback and unfortunate misinformation circulating online.”
These include claims that Bambu Lab will remotely disable 3D printers, firmware updates will block the ability to print, AMS functionality will be restricted and third-party filaments disabled, and that the update contains trojans or backdoors for unauthorized remote control. Claims that Bambu 3D printers have a timed killswitch, 3D print files are monitored and stolen, and a subscription will be required to use Bambu Lab 3D printers have also been made. The company asserts that all these accusations “are entirely false.”
Bambu Lab also responded to concerns regarding camera feed privacy. The company clarified that its Live View service uses Peer-to-Peer (P2P) connection, meaning video is streamed directly between the user’s computer device and 3D printer. Server forwarding is used when P2P isn’t possible. However, Bambu confirmed that “no video is ever stored on any server.”
The Shenzhen-based company also addressed concerns related to Panda Touch, a third-party Bambu Lab touch screen that utilizes exploited MQTT protocols. Bambu Lab reportedly reached out to the products designer, Big Tree Tech, warning that these protocols are unsustainable and would cause issues following system updates. According to Bambu Lab, this communication occurred before mass shipments of the Panada Touch, with the warning being ignored.
“Unfortunately, the truth is now being presented in a misleading manner,” added Bambu Lab. “The same concerns apply to other products they manufacture that rely on these MQTT protocols.”
The interaction and resulting friction between geopolitics, commerce, and technology is not new. A U.S. ban on TikTok cites data privacy concerns among the reasons given for its removal from app stores. Commentators have suggested a more fundamental rationale is the ongoing race for AI supremacy. In the 3D printing industry, America Makes has sought to tackle issues around cyber security, as this guest post on cyber security risk in manufacturing by the former President and Executive Director of the National Center for Defense Manufacturing and Machining illustrates.
Who won the 2024 3D Printing Industry Awards?
All the news from Formnext 2024.
Subscribe to the 3D Printing Industry newsletter to keep up with the latest 3D printing news.
You can also follow us on X, like our Facebook page, and subscribe to the 3D Printing Industry Youtube channel to access more exclusive content.
Featured image shows a Bambu Lab X1-Carbon 3D printer. Image via Bambu Lab.
