What’s Vulnerable › Vulnerabilities
CVE-2024-51978: Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 15.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-06-25 · updated 2026-06-17
- Weakness: CWE-1391
Description
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
Affected products
- Brother Industries, Ltd ADS-1250W: through R(3.75)
- Brother Industries, Ltd ADS-1350W: through C(1.06)
- Brother Industries, Ltd ADS-1700W: through R(3.75)
- Brother Industries, Ltd ADS-1800W: through C(1.06)
- Brother Industries, Ltd ADS-2700W: through M(4.28)
- Brother Industries, Ltd ADS-2700We: through P(2.28)
- Brother Industries, Ltd ADS-3300W: through P(2.28)
- Brother Industries, Ltd ADS-4300N: through P(2.28)
- Brother Industries, Ltd ADS-4500W: through P(2.28)
- Brother Industries, Ltd ADS-4700W: through P(2.28)
- Brother Industries, Ltd ADS-4900W: through P(2.28)
- Brother Industries, Ltd DCP-1610W: through ZB
- Brother Industries, Ltd DCP-1610WE: through ZB
- Brother Industries, Ltd DCP-1610WR: through ZB
- Brother Industries, Ltd DCP-1612W: through ZB
- Brother Industries, Ltd DCP-1612WE: through ZB
- Brother Industries, Ltd DCP-1612WR: through ZB
- Brother Industries, Ltd DCP-1615NW: through S
- Brother Industries, Ltd DCP-1616NW: through S
- Brother Industries, Ltd DCP-1617NW: through S
- Brother Industries, Ltd DCP-1618W: through R
- Brother Industries, Ltd DCP-1622WE: through ZB
- Brother Industries, Ltd DCP-1623WE: through ZB
- Brother Industries, Ltd DCP-1623WR: through ZB
- Brother Industries, Ltd DCP-7090DW: through M
- Brother Industries, Ltd DCP-7180DN: through R
- Brother Industries, Ltd DCP-7189DW: through R
- Brother Industries, Ltd DCP-7190DN: through V
- Brother Industries, Ltd DCP-7190DW: through M
- Brother Industries, Ltd DCP-7195DW: through R
References
- https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml
- https://github.com/rapid7/metasploit-framework/pull/20349
- https://github.com/sfewer-r7/BrotherVulnerabilities
- https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
- https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
- https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000
- https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf
- https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
- https://www.toshibatec.com/information/20250625_02.html
- https://www.bleepingcomputer.com/news/security/brother-printer-bug-in-689-models-exposes-default-admin-passwords/
- https://www.darkreading.com/endpoint-security/millions-brother-printers-critical-unpatchable-bug
Get alerted when CVE-2024-51978 or the next vulnerability affects your stack