Security researchers have discovered a set of eight vulnerabilities that affect millions of enterprise and home printers from Brother around the world. If exploited, the vulnerabilities let a remote attacker take over the device and hamper its intended functionality.
The vulnerabilities were discovered by researchers at Rapid7. Their report claims that these vulnerabilities affect 689 printer, scanner, and label maker models from Brother. Some of these flaws also affect 46 Fujifilm Business Innovation, 5 Ricoh, 6 Konica Minolta, and 2 Toshiba printers.
Almost all of the vulnerabilities affect the HTTP and HTTPS ports on the device, with the most severe vulnerability, dubbed CVE-2024-51978, rated 9.8 on the CVSS scale. The vulnerabilities are as follows
| Vulnerability | CVSS Score | Description |
|---|---|---|
| CVE-2024-51977 | 5.3 | Allows sensitive data leak |
| CVE-2024-51978 | 9.8 | Allows hackers to generate default administrator password |
| CVE-2024-51979 | 7.2 | Triggers a stack-based buffer overflow |
| CVE-2024-51980 | 5.3 | Forces the device to perform an arbitrary HTTP request |
| CVE-2024-51981 | 5.3 | Can crash the device |
| CVE-2024-51982 | 7.5 | Can crash the device |
| CVE-2024-51983 | 7.5 | Can crash the device |
| CVE-2024-51984 | 6.8 | Discloses the password of a configured external service |
The most severe vulnerability of the bunch is CVE-2024-51978. If exploited correctly, it allows a remote attacker to bypass authentication on the target printer by generating the device’s default administrator password. It can also be chained with CVE-2024-51977 to obtain the device’s serial number, which can be used to generate the default admin password. Six of the vulnerabilities can be exploited without authentication as well, which significantly increases risk of exploitation.
The vulnerabilities were reported to Brother in 2024 via Japan’s JPCERT/CC, leading to advisories being issued by the company. Most of the flaws have already been patched in software updates. However, CVE-2024-51978 cannot be fully patched via software updates, leading to a new manufacturing process that ensures future devices aren’t vulnerable.
In the News: Apple and Android app stores found offering spyware
