Medium severity · published Jun 25, 2025
CVE-2024-51984
Authenticated disclosure of external service passwords via pass-back attack affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
6.8
CVSS
1%
EPSS
No
On KEV
Description
An authenticated attacker can reconfigure the target device to use an external service (such as LDAP or FTP) controlled by the attacker. If an existing password is present for an external service, the attacker can force the target device to authenticate to an attacker controlled device using the existing credentials for that external service. In the case of an external LDAP or FTP service, this will disclose the plaintext password for that external service to the attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCP-L5510DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5510DW · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5512DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5518DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5610DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5660DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5662DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L8410CDW · Brother Industries, Ltd
through ZK · source: vendor
HL
HL-EX415DW · Brother Industries, Ltd
through 1.16(G) · source: vendor
HL
HL-L5210DN · Brother Industries, Ltd
1.0 through 1.14(H) · source: vendor
HL
HL-L5210DW · Brother Industries, Ltd
1.0 through 1.14(H) · source: vendor
HL
HL-L5210DWT · Brother Industries, Ltd
through 1.14(H) · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51984
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51984
assets.contentstack.io
https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
github.com
https://github.com/sfewer-r7/BrotherVulnerabilities
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000
www.fujifilm.com
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html
More from DCP-L5510DN
7.5
CVE-2024-51983
Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
7.2
CVE-2024-51979
Authenticated stack based buffer overflow affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Konica Minolta, Inc.
5.3
CVE-2024-51981
Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.
5.3
CVE-2024-51980
Unauthenticated Server Side Request Forgery (SSRF) via WS-Addressing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
4.3
CVE-2025-8452
Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.