Loading vulnerability…
CVE-2024-51978 is a critical authentication bypass issue affecting Brother multifunction printers and related models across multiple vendors. The vulnerability arises because the device's default administrator password can be derived from the device serial number. An unauthenticated attacker who knows the target device's serial number can generate the default administrator password and then authenticate as an administrator. The serial number may be obtained remotely via HTTP/HTTPS/IPP through the related information disclosure issue CVE-2024-51977, or via PJL or SNMP requests. Rapid7 identified this as the most critical of a set of printer vulnerabilities, and the issue is described as unpatchable on affected Brother devices, with a vendor workaround instead of a firmware fix.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a single Metasploit auxiliary module targeting multiple Brother devices (printers, scanners, label printers) vulnerable to authentication bypass (CVE-2024-51978) and serial number information leak (CVE-2024-51977). The module exploits the fact that the default administrator password can be generated from the device's serial number, which may be obtainable via unauthenticated HTTP, HTTPS, IPP, SNMP, or PJL requests. The module first attempts to retrieve the serial number using the specified protocol, then generates the default password using a pseudo-hashing algorithm, and finally attempts to authenticate to the device's web admin console. If successful, it provides administrator access to the attacker. The module is written in Ruby and is designed to be used within the Metasploit framework. The main attack vector is network-based, targeting exposed management interfaces on the device. The code is operational and provides credential generation and login functionality, but does not deliver a shell or arbitrary code execution.
This repository contains proof-of-concept (PoC) exploit scripts for seven vulnerabilities (CVE-2024-51977 through CVE-2024-51983) affecting Brother multifunction printers and related OEM devices. Each exploit is implemented as a standalone Ruby script, targeting a specific CVE. The exploits cover a range of attack types: - CVE-2024-51977: Leaks sensitive information from the printer via unauthenticated HTTP(S)/IPP request to /etc/mnt_info.csv. - CVE-2024-51978: Allows an unauthenticated attacker to generate the device's default administrator password, either by leaking the serial number or by providing it directly. - CVE-2024-51979: Authenticated stack-based buffer overflow via crafted HTTP requests, potentially leading to code execution or denial of service. - CVE-2024-51980: Unauthenticated SSRF/port scan via SOAP requests, allowing the attacker to force the printer to open TCP connections to arbitrary internal hosts/ports. - CVE-2024-51981: Unauthenticated SSRF, forcing the device to perform arbitrary HTTP requests to internal or external hosts. - CVE-2024-51982: Unauthenticated device crash via malformed PJL commands sent over TCP port 9100. - CVE-2024-51983: Unauthenticated device crash via crafted SOAP requests to the printer's web services endpoint. The repository also includes a ReadMe.md with detailed descriptions, affected models, and usage instructions, as well as a simple Sinatra server (sinatra_server.rb) for testing SSRF payloads. All scripts are written in Ruby and require minimal dependencies (primarily 'httparty'). The exploits are PoC-level and focus on demonstrating the vulnerabilities rather than providing weaponized payloads. The main attack vector is network-based, targeting exposed printer services over HTTP, HTTPS, IPP, and PJL.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A high-severity issue in Brother multifunction printers where default admin passwords are derivable (based on device serial number), enabling attackers to obtain the default administrator password; described as unpatchable on affected models.
A critical vulnerability in Brother and other vendors' printers and scanners that allows remote unauthenticated attackers to leak device serial numbers and generate the default administrator password, enabling device reconfiguration or abuse.
An authentication bypass vulnerability in over 700 Brother printer models, where the device's serial number can be used as the default admin password. This vulnerability cannot be fixed in existing models.
A critical authentication bypass vulnerability in multiple Brother Industries, Ltd and Toshiba Tec printer models allows an unauthenticated attacker to generate the default administrator password if the device's serial number is known. The serial number can be obtained remotely via other means, enabling full compromise of the device.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.