Severe safety flaws have been present in tons of of Brother printer fashions that would permit attackers to remotely entry units which can be nonetheless utilizing default passwords. Eight new vulnerabilities, one among which can’t be fastened by patching the firmware, have been found in 689 sorts of Brother house and enterprise printers by security company Rapid7.
The failings additionally affect 59 printer fashions from Fujifilm, Toshiba, Ricoh, and Konica Minolta, however not each vulnerability is discovered on each printer mannequin. For those who personal a Brother printer, you may verify to see if your model is affected here.
Essentially the most critical safety flaw, tracked beneath CVE-2024-51978 in the National Vulnerability Database, has a 9.8 “Critical” CVSS rating and permits attackers to generate the system’s default admin password in the event that they know the serial variety of the printer they’re focusing on. This permits attackers to use the opposite seven vulnerabilities found by Rapid7, which embody retrieving delicate data, crashing the system, opening TCP connections, performing arbitrary HTTP requests, and exposing passwords for related community companies.
Whereas seven of those safety flaws may be fastened through firmware updates detailed in Rapid7’s report, Brother indicated to the corporate that CVE-2024-51978 itself “can’t be totally remediated in firmware,” and shall be fastened through a change to the manufacturing course of for future variations of affected printer fashions. For present fashions, Brother recommends that customers change the default admin password for his or her printer through the device’s Web-Based Management menu
Altering default manufacturing passwords is one thing we must always all be doing once we take a brand new system house anyway, and these printer vulnerabilities are a very good instance as to why.