Security researchers from Rapid7 have discovered eight vulnerabilities that mainly affect Brother printers, but also those from other manufacturers. Specifically for Brother, one of the vulnerabilities cannot be resolved with a patch.
Researchers from Rapid7 have discovered eight vulnerabilities in printers. Brother is hit the hardest: 689 different models from the manufacturer are susceptible to one of the bugs. Some other printer manufacturers also face leaks in the firmware of their models. 46 devices from Fujifilm are affected, as well as six devices from Konica Minolta, five from Ricoh, and two from Toshiba.
Built-in Default Password
The most serious bug is CVE-2024-51978. It allows attackers to generate an administrator password based on the device’s serial number. This serial number can be obtained in various ways. Brother printers generate a default admin password based on that serial number.
In essence, Brother has built in a hardware-based administrator password, but with some modalities to hide it. Now that the link with the serial number has been established, attackers can work with the administrator password. The password is activated during the production process of the printers, and there is no way to fully close the leak via firmware.
Brother has since adjusted the production of its printers so that a serial number-based default password is no longer built in. Only new devices are safe from this bug. Fortunately, there is another very simple solution: administrators can manually change the default password to something else. This solves the problem. However, they must do this for all affected printers.
Other Bugs
The other vulnerabilities are related to various minor bugs. Their impact varies. These include buffer overflows, denial-of-service problems, and server-side request forgery (SSRF). Two vulnerabilities allow an attacker to crash the device, disrupting availability. Another vulnerability makes it possible to intercept passwords from external services such as LDAP or FTP, provided the attacker already has access.
Updates
All these bugs can be resolved with a firmware update. Brother and the other manufacturers have rolled out updates for the affected devices. Each manufacturer shares additional details about affected devices on specific pages:
- Brother Laser and Inkjet Printer
- Brother Document Scanner
- Brother Label Printer
- Fujifilm Business Innovation
- Ricoh
- Toshiba
- Konica Minolta
At this time, there are no indications of exploitation in the wild. It goes without saying that you shouldn’t wait for that and should install available security updates immediately.