CVE-2024-51983

Published: Jun 25, 2025Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: cve@rapid7.com (Secondary)

Description

An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.

Related CWEs

Improper Validation of Syntactic Correctness of Input

The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.

References (10)

https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf

Source: cve@rapid7.com

https://github.com/sfewer-r7/BrotherVulnerabilities

Source: cve@rapid7.com

https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000

Source: cve@rapid7.com

https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000

Source: cve@rapid7.com

https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html

Source: cve@rapid7.com

https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf

Source: cve@rapid7.com

https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed

Source: cve@rapid7.com

https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007

Source: cve@rapid7.com

https://www.toshibatec.com/information/20250625_02.html

Source: cve@rapid7.com

https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.