CVE-2017-16249
HIGHBrother DCP-J132W Firmware < 1.20 - Denial of Service via Malformed HTTP POST Request
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2017-16249.
PoCs published by z00n, z00n <[email protected]>, h00die, including Metasploit module auxiliary/dos/http/brother_debut_dos.
AI-analyzed exploit summary This exploit demonstrates a remote unauthenticated denial-of-service (DoS) vulnerability in Brother printers' Debut embedded HTTP server by sending a malformed HTTP POST request, causing the server to hang and eventually respond with an HTTP 500 error.
Description
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.
Exploits (2)
This exploit demonstrates a remote unauthenticated denial-of-service (DoS) vulnerability in Brother printers' Debut embedded HTTP server by sending a malformed HTTP POST request, causing the server to hang and eventually respond with an HTTP 500 error.
This Metasploit module exploits a Denial of Service (DoS) vulnerability in Brother Debut embedded HTTP servers by sending a malformed POST request with a mismatched Content-Length header, causing the server to hang for ~300 seconds.
References (4)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H