CVE-2018-11581

Severity: medium (CVSS 4.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-01 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.

Affected products

Brother Hl-L2340D Firmware: before 1.16 — fixed in 1.16
Brother Hl-L2380Dw Firmware: before 1.16 — fixed in 1.16

How to fix

Upgrade to a fixed version: Brother Hl-L2340D Firmware 1.16; Brother Hl-L2380Dw Firmware 1.16. Check the vendor advisory for mitigations.

References

https://support.brother.com/g/b/faqend.aspx?c=us_ot&lang=en&prod=group2&ftype3=100033&faqid=faq00100530_000
https://www.exploit-db.com/exploits/44839/
https://support.brother.com/g/b/faqend.aspx?c=us_ot&lang=en&prod=group2&ftype3=100033&faqid=faq00100530_000
https://www.exploit-db.com/exploits/44839/

Get alerted when CVE-2018-11581 or the next vulnerability affects your stack