Hundreds of printer models from Brother and other vendors are impacted by potentially serious vulnerabilities discovered by researchers at Rapid7.
The cybersecurity firm revealed on Wednesday that its researchers identified eight vulnerabilities affecting multifunction printers made by Brother.
The security holes have been found to impact 689 printer, scanner and label maker models from Brother, and some or all of the flaws also affect 46 Fujifilm Business Innovation, five Ricoh, six Konica Minolta, and two Toshiba printers.
Overall, millions of enterprise and home printers are believed to be exposed to hacker attacks due to these vulnerabilities.
The most serious of the flaws, tracked as CVE-2024-51978 and with a severity rating of ‘critical’, can allow a remote and unauthenticated attacker to bypass authentication by obtaining the device’s default administrator password.
CVE-2024-51978 can be chained with an information disclosure vulnerability tracked as CVE-2024-51977, which can be exploited to obtain a device’s serial number. This serial number is needed to generate the default admin password.
“This is due to the discovery of the default password generation procedure used by Brother devices,” Rapid7 explained. “This procedure transforms a serial number into a default password. Affected devices have their default password set, based on each device’s unique serial number, during the manufacturing process.”
Having the admin password enables an attacker to reconfigure the device or abuse functionality intended for authenticated users.
The remaining vulnerabilities, which have severity ratings of ‘medium’ and ‘high’, can be exploited for DoS attacks, forcing the printer to open a TCP connection, obtain the password of a configured external service, trigger a stack overflow, and perform arbitrary HTTP requests. Six of the eight vulnerabilities found by Rapid7 can be exploited without authentication.
The cybersecurity company reported its findings to Brother roughly one year ago through Japan’s JPCERT/CC, and the vendor has released advisories to inform customers about these vulnerabilities.
Brother has patched most of the flaws, but said CVE-2024-51978 cannot be fully patched in the firmware. A new manufacturing process will ensure that future devices are not vulnerable. For existing devices, a workaround is available.
Advisories have also been published by JPCERT/CC, Ricoh, Fujifilm, Toshiba, and Konica Minolta.
*updated with links to vendor advisories
Related: Xerox Versalink Printer Vulnerabilities Enable Lateral Movement
Related: Printer Company Procolored Served Infected Software for Months
Related: Critical Vulnerability Found in Canon Printer Drivers
