CVE-2024-51978

Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.

An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

Affected

Brother Industries, Ltd · Toshiba Tec · Konica Minolta, Inc. · DCP-J928N-W/B · MFC-J1800DW (Europe) · MFC-J1800DW (USA) · MFC-J4340DWE · MFC-J4345DWXL · MFC-J5855DWXL

CVSS v3.1 RAPID7

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

15.83% chance of exploitation in the next 30 days, 97th percentile

Nuclei

critical · CWE-1391

Published

2025-06-25

Updated

2026-03-30

Proof-of-concept exploits (3)

• rapid7/metasploit-framework/pull/2034939154★ · 2026-10-15
• sfewer-r7/BrotherVulnerabilities35★ · 2025-06-30
• thx0701/POC1★ · 2025-06-28

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2017-14705
• CVE-2020-7377
• CVE-2022-23227
• CVE-2023-27532
• CVE-2023-34362
• CVE-2024-51977