CVE-2024-51977
published 2025-06-25CVE-2024-51977: An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak…
PriorityP181medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
77.47%
99.5th percentile
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.
Affected
406 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| brother_industries_ltd | ads-1350w | <= C(1.06) | — |
| brother_industries_ltd | ads-1800w | <= C(1.06) | — |
| brother_industries_ltd | ads-2700we | <= P(2.28) | — |
| brother_industries_ltd | ads-3300w | <= P(2.28) | — |
| brother_industries_ltd | ads-4300n | <= P(2.28) | — |
| brother_industries_ltd | ads-4500w | <= P(2.28) | — |
| brother_industries_ltd | ads-4700w | <= P(2.28) | — |
| brother_industries_ltd | ads-4900w | <= P(2.28) | — |
| brother_industries_ltd | dcp-7090dw | <= M | — |
| brother_industries_ltd | dcp-7190dn | <= V | — |
| brother_industries_ltd | dcp-7190dw | <= M | — |
| brother_industries_ltd | dcp-7195dw | <= R | — |
| brother_industries_ltd | dcp-9030cdn | <= ZE | — |
| brother_industries_ltd | dcp-b7520dw | <= V | — |
| brother_industries_ltd | dcp-b7530dn | <= V | — |
| brother_industries_ltd | dcp-b7535dw | <= V | — |
| brother_industries_ltd | dcp-b7548w | <= 1.16(F) | — |
| brother_industries_ltd | dcp-b7558w | <= 1.16(F) | — |
| brother_industries_ltd | dcp-b7578dw | <= 1.16(F) | — |
| brother_industries_ltd | dcp-b7600d | <= 1.20(J) | — |
| brother_industries_ltd | dcp-b7600db | <= 1.20(J) | — |
| brother_industries_ltd | dcp-b7608w | <= 1.16(F) | — |
| brother_industries_ltd | dcp-b7620dw | <= 1.20(J) | — |
| brother_industries_ltd | dcp-b7620dwb | <= 1.20(J) | — |
| brother_industries_ltd | dcp-b7628dw | <= 1.16(F) | — |
Detection & IOCsextracted from sources · hover to see the quote
path/etc/mnt_info.csv
port443
port631
sigma
id: CVE-2024-51977
http:
- method: GET
path:
- "{{BaseURL}}/etc/mnt_info.csv"
matchers-condition: and
matchers:
- type: word
part: body
words:
- '"Model Name"'
- '"IP Address"'
condition: and
- type: dsl
dsl:
- "status_code == 200"
- 'contains(content_type, "text/comma-separated-values")'
condition: and- →Send an unauthenticated HTTP GET request to /etc/mnt_info.csv on ports 80, 443, or 631; a vulnerable Brother device will respond with HTTP 200 and Content-Type: text/comma-separated-values containing fields including 'Model Name' and 'IP Address'.
- →Use Shodan query html:"MFC-L9570CDW" or FOFA query app="brother-Printer" to identify internet-exposed vulnerable Brother printers.
- →The leaked serial number from /etc/mnt_info.csv can be chained with CVE-2024-51978 to calculate the default administrator password; monitor for unauthenticated access to this path as a precursor to authentication bypass. ↗
- ·The eSCL/uscan vector (CVE-2025-8452) is a related but distinct path to obtain the serial number; it is typically only exposed on the local network, unlike the HTTP/HTTPS/IPP vector of CVE-2024-51977. ↗
- ·Changing the default administrator password renders the chained CVE-2024-51978 exploitation worthless, even if the serial number is leaked via CVE-2024-51977. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
vulncheck5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-7q89-r4x7-5664: By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement
ghsa_unreviewed·2025-08-12·CVSS 5.3
CVE-2025-8452 [MEDIUM] CWE-538 GHSA-7q89-r4x7-5664: By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement
By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless,
GHSA
GHSA-27h4-8c24-mx7w: An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631),
ghsa_unreviewed·2025-06-26
CVE-2024-51977 [MEDIUM] CWE-538 GHSA-27h4-8c24-mx7w: An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631),
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.
GHSA
GHSA-2mr3-j246-x7x3: An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device
ghsa_unreviewed·2025-06-26·CVSS 5.3
CVE-2024-51978 [MEDIUM] CWE-1391 GHSA-2mr3-j246-x7x3: An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
VulnCheck
Use of Weak Credentials
vulncheck·2024·CVSS 5.3
CVE-2024-51978 [MEDIUM] Use of Weak Credentials
Use of Weak Credentials
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
Affected: Brother Industries, Ltd./FUJIFILM Business Innovation/Ricoh/Toshiba Tec/Konica Minolta, Inc. Multiple Printer Devices
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://app.crowdsec.net/cti/cve-explorer/CVE-2024-51978
Exploit PoC: https://vulncheck.com/xdb/20e9ac05cdf5
VulnCheck
Insertion of Sensitive Information into Externally-Accessible File or Directory
vulncheck·2024·CVSS 5.3
CVE-2024-51977 [MEDIUM] Insertion of Sensitive Information into Externally-Accessible File or Directory
Insertion of Sensitive Information into Externally-Accessible File or Directory
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.
Affected: Brother Industries, Ltd./FUJIFILM Business Innovation/Ricoh/Toshiba Tec/Konica Minolta, Inc. Multiple Printer Devices
Required Action: Apply remediations or mitigations per vendor instructions or discontin
No detection rules found.
Nuclei
Brother MFC-L9570CDW - Information Disclosure
nuclei·CVSS 5.3
CVE-2024-51977 [MEDIUM] Brother MFC-L9570CDW - Information Disclosure
Brother MFC-L9570CDW - Information Disclosure
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.
Template:
id: CVE-2024-51977
info:
name: Brother MFC-L9570CDW - Information Disclosure
author: DhiyaneshDK,iamnoooob,darses
severity: medium
description: |
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS
Metasploit
Multiple Brother devices authentication bypass via default administrator password generation
metasploit
Multiple Brother devices authentication bypass via default administrator password generation
Multiple Brother devices authentication bypass via default administrator password generation
By leaking a target devices serial number, a remote attacker can generate the target devices default administrator password. The target device may leak its serial number via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests.
Bleepingcomputer
Brother printer bug in 689 models exposes default admin passwords
blogs_bleepingcomputer·2025-06-26·CVSS 5.3
CVE-2024-51978 [MEDIUM] Brother printer bug in 689 models exposes default admin passwords
## Brother printer bug in 689 models exposes default admin passwords
## Bill Toulas
A total of 689 printer models from Brother, along with 53 other models from Fujifilm, Toshiba, and Konica Minolta, come with a default administrator password that remote attackers can generate. Even worse, there is no way to fix the flaw via firmware in existing printers.
The flaw, tracked under CVE-2024-51978 , is part of a set of eight vulnerabilities discovered by Rapid7 researchers during a lengthy examination of Brother hardware.
CVE-2024-51977
An unauthenticated attacker can leak sensitive information.
HTTP (Port 80), HTTPS (Port 443), IPP (Port 631)
5.3 (Medium)
CVE-2024-51978
An unauthenticated attacker can generate the device's default administrator password.
HTTP (Port 80), HTTPS (Port 4
Greynoiseio
NoiseLetter July 2025
blogs_greynoiseio
NoiseLetter July 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdfhttps://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51977.yamlhttps://github.com/sfewer-r7/BrotherVulnerabilitieshttps://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.htmlhttps://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdfhttps://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixedhttps://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007https://www.toshibatec.com/information/20250625_02.htmlhttps://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
2025-06-25
Published
Exploited in the wild