Some Brother printers have a remote code execution vulnerability, and they can’t fix it – Source: www.csoonline.com

Brother Industries is grappling with a critical authentication bypass vulnerability affecting hundreds of different printer models, many of them used in enterprises, allowing unauthenticated remote code execution (RCE) on the devices when chained with another flaw.

The admin password bypass stems from a manufacturing issue and cannot be fixed through firmware according to Rapid7, the cybersecurity firm that discovered the vulnerability — along with seven others — affecting 689 different device models.

One of those vulnerabilities enables attackers to extract the serial number of a printer, and that’s at the root of Brother’s problems.

“This is due to the discovery of the default password generation procedure used by Brother devices,” Rapid7 said in a blog post. “This procedure transforms a serial number into a default password. Affected devices have their default password set, based on each device’s unique serial number, during the manufacturing process.”

Other serious bugs uncovered include info leaks, server-side request forgery, crash-inducing flaws and credential disclosure.

The centerpiece of Rapid7’s disclosure is CVE-2024-51978, a vulnerability rated critical (CVSS 9.8 out of 10) that enables attackers to derive the default administrator password from the device’s serial number.

While another of the discovered flaws, a medium severity information disclosure vulnerability (CVE-2024-51977), potentially allows an attacker to leak the prerequisite unique serial number via the target’s HTTP, HTTPS, and IPP services, the serial can also be obtained through more honest query using SNMP (simple network management protocol) or PJL (printer job language).

Once admin access is achieved, it can be used to exploit CVE-2024-51979, a high-severity stack-based buffer overflow (CVSS 7.2) reachable over the same interfaces (communication channels or ports) as the first one.

Security blind spot

The combination of these flaws effectively enables unauthenticated remote code execution as the attacker can send specially crafted malicious input through the memory overflow.

Commenting on the discovery, John Bambanek of Bambanek Consulting noted that printers remain a typical blind spot in IT security. “Printers are often a ‘plug it in and forget it’ type of IT device and are easy to overlook for updates and security patches,” he said. “However, they have operating systems and can be used for easy lateral movement and persistence by attackers who want to remain in a target environment quietly.”

Rapid7 noted that chaining these two vulnerabilities gives attackers full control without the need for credentials or physical access.

While Brother has addressed CVE-2024-51979 through firmware updates, fixing CVE-2024-51978 will need the users to replace their printer with a new model without the manufacturing flaw.

“Brother has indicated that this vulnerability cannot be fully remediated in firmware, and has required a change to the manufacturing process of all affected models,” Rapid7 said.

Brother did not respond to a request for comment.

From data drips to full device crashes

Rapid7’s identified seven additional vulnerabilities in Brother devices, ranging from mildly concerning to potentially disruptive. Among the more serious ones are the two denial-of-service (DOS) bugs, CVE-2024-51982 and CVE-2024-51983 with CVSS scores of 7.5 each that can crash devices via malformed PJL or HTTP inputs.

Two others, CVE-2024-51980 and CVE-2024-51981, enable server-side request forgery (SSRF), allowing printers to send crafted requests into internal networks they shouldn’t be talking to. In corporate environments, this could let attackers probe internal services, bypass access controls, or pivot deeper into the network. Finally, CVE-2024-51984 exposes plaintext credentials for services such as LDAP or FTP to authenticated users, offering a potential jump-off point for wider compromise.

In addition to 689 models of Brother printers, scanners, and label makers, some of the vulnerabilities affect 46 Fujifilm models, 5 from Ricoh, 2 from Toshiba Tec, and 6 from Konica Minolta.

Except for Brother’s admin bypass flaw, all vulnerabilities have been addressed through respective firmware updates, Rapid7 added.