CVE-2024-51977

MEDIUM EXPLOITED NUCLEI

Multiple Brother devices authentication bypass via default administrator password generation

Title source: metasploit

Exploitation Summary

CVE-2024-51977 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including iSee857, sfewer-r7, including a Metasploit module auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978. A Nuclei detection template is also available.

AI-analyzed exploit summary The repository contains functional exploit code for CVE-2024-51977, specifically targeting Brother Printers for information disclosure. The provided script demonstrates the vulnerability by sending crafted requests to exposed endpoints.

Description

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.

Exploits (3)

github WORKING POC 40 stars

by iSee857 · pythonpoc

https://github.com/iSee857/CVE-PoC/tree/main/BrotherPrinters-CVE-2024-51977-InformationDisclosure.py

View Code ZIP pw:eip

The repository contains functional exploit code for CVE-2024-51977, specifically targeting Brother Printers for information disclosure. The provided script demonstrates the vulnerability by sending crafted requests to exposed endpoints.

Classification

Working Poc 95%

Attack Type

Info Leak

Complexity

Moderate

Reliability

Reliable

Target: Brother Printers

No auth needed

Prerequisites: Network access to the target printer

MITRE ATT&CK

T1005 - Data from Local System T1552 - Unsecured Credentials

devstral-2 · analyzed Feb 27, 2026 Full analysis →

nomisec WORKING POC 29 stars

by sfewer-r7 · infoleak

https://github.com/sfewer-r7/BrotherVulnerabilities

View Code ZIP pw:eip

This PoC exploits an unauthenticated information leak vulnerability in Brother printers by fetching and parsing a CSV file containing sensitive system information. The script demonstrates the ability to retrieve device details without authentication.

Classification

Working Poc 95%

Attack Type

Info Leak

Complexity

Trivial

Reliability

Reliable

Target: Brother MFC-L9570CDW (MAIN: ZL2403011354, SUB1: 1.32)

No auth needed

Prerequisites: Network access to the target printer · HTTP/HTTPS access to the printer's web interface

MITRE ATT&CK

T1082 - System Information Discovery

devstral-2 · analyzed Feb 16, 2026 Full analysis →

metasploit WORKING POC

by sfewer-r7 · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb

View Code ZIP pw:eip

This Metasploit module exploits CVE-2024-51977 and CVE-2024-51978 to bypass authentication on multiple Brother devices by leaking the serial number via HTTP, SNMP, or PJL, then generating the default admin password using a pseudo-hashing algorithm.

Classification

Working Poc 95%

Attack Type

Auth Bypass

Complexity

Moderate

Reliability

Reliable

Target: Brother Laser/Inkjet Printers, Document Scanners, Label Printers

No auth needed

Prerequisites: Network access to the target device · HTTP/HTTPS/IPP/SNMP/PJL services exposed

MITRE ATT&CK