CVE-2024-51978

CRITICAL 9.8CVE-2024-51978 · Published 25/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

References

assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
projectdiscovery/nuclei-templates
rapid7/metasploit-framework#20349
sfewer-r7/BrotherVulnerabilities
support.brother.com/g/b/link.aspx
support.brother.com/g/b/link.aspx
support.brother.com/g/b/link.aspx
konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf
rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
toshibatec.com/information/20250625_02.html
bleepingcomputer.com/news/security/brother-printer-bug-in-689-models-exposes-default-admin-passwords
darkreading.com/endpoint-security/millions-brother-printers-critical-unpatchable-bug
securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free