Critical severity · published Jun 25, 2025
CVE-2024-51978
Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
9.8
CVSS
15.8%
EPSS
No
On KEV
Description
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)15.8% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCP-B7520DW (China) · Brother Industries, Ltd
A through V · source: vendor
DC
DCP-B7535DW (China) · Brother Industries, Ltd
A through V · source: vendor
DA
DCP-B7640DW (Asia) · Brother Industries, Ltd
1.0 through 1.16(F) · source: vendor
DC
DCP-J928N-W/B · Brother Industries, Ltd
1.0 through 1.03(B) · source: vendor
DC
DCP-L2535DW (China) · Brother Industries, Ltd
A through M · source: vendor
DJ
DCP-L2540DW (Japan) · Brother Industries, Ltd
A through T · source: vendor
DC
DCP-L2550DW (China) · Brother Industries, Ltd
A through M · source: vendor
DJ
DCP-L2550DW (Japan) · Brother Industries, Ltd
A through R · source: vendor
DT
DCP-L2550DW (Taiwan) · Brother Industries, Ltd
A through V · source: vendor
DJ
DCP-L2660DW (Japan) · Brother Industries, Ltd
1.0 through 1.08(C) · source: vendor
DC
DCP-L8410CDW · Brother Industries, Ltd
through ZK · source: vendor
DS
DS-940DW · Brother Industries, Ltd
A through G(1.7) · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51978
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51978
assets.contentstack.io
https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
github.com
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml
github.com
https://github.com/rapid7/metasploit-framework/pull/20349
github.com
https://github.com/sfewer-r7/BrotherVulnerabilities
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
More from DCP-B7520DW (China)
5.3
CVE-2024-51977
Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.