CVE-2024-51978

Deeper analysis

The vulnerability CVE-2024-51978 allows an unauthenticated attacker to generate the default administrator password on affected devices simply by knowing the target serial number. It is tracked under CWE-1391 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation with no required credentials or user interaction. The issue impacts Brother devices that rely on predictable default credentials derived from serial numbers.

An attacker can first obtain the serial number through the related flaw CVE-2024-51977 over HTTP, HTTPS, or IPP, or by sending PJL or SNMP requests, then compute the corresponding default administrator password to achieve full administrative access.

Vendor advisories and a detailed disclosure whitepaper hosted by Brother outline mitigation steps, while public references include a Nuclei detection template and a Metasploit module that demonstrate the issue.

The EPSS score has reached 0.5360 with matching peak value, and multiple public exploit implementations have been published.