CVE-2024-51978 is a critical flaw (CWE-1391, use of a weak pseudo-random number generator) in how Brother Industries manufactures printers and MFPs: every affected device's default administrator password is mathematically derived from its own serial number, so an unauthenticated attacker who learns a device's serial number can compute its default admin password and log in with full administrative control, and because NVD has not, as of 2026-11-08, published its own Primary CVSS score, this page shows only the Secondary rating the discovering researcher submitted.
Vulnerability summary
CVSS base score
N/A
No NVD score published as of
EPSS score (FIRST)
15.8%
Probability of exploitation in the wild in the next 30 days
CISA KEV catalog
No
Not listed
Published
Vulnerability ID: CVE-2024-51978 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Brother-firmware network printers and multifunction printers (MFPs), including devices sold under the Brother brand and OEM variants rebranded by FUJIFILM Business Innovation, Ricoh, Toshiba Tec and Konica Minolta that share the same Brother-supplied firmware | — | Per security researcher Rapid7's disclosure, 695 of 748 total device models across the five vendors are affected by this specific flaw (the remaining 53 models in the same bundle are affected only by the companion information-disclosure flaw CVE-2024-51977); exact model numbers and firmware versions are listed in the vendor FAQ pages linked in this advisory's sources, since neither NVD's nor Rapid7's own text enumerates all 695 individually |
What does this mean for affected devices?
CVE-2024-51978 (CWE-1391, use of a weak pseudo-random number generator) affects printers and MFPs running Brother-supplied firmware. NVD's description states: "An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request" (NVD).
That companion flaw, CVE-2024-51977, is itself a serious information-disclosure bug: NVD's description for it explains that "the URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required," returning a CSV table that leaks "the device's model, firmware version, IP address, and serial number" to anyone who can reach the device's HTTP, HTTPS or IPP service — no login required (NVD).
NVD tracks CVE-2024-51978 with status "Deferred": it records only a Secondary score submitted by the discovering researcher (source [email protected]) — CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD).
Stephen Fewer, Principal Security Researcher at Rapid7, discovered and reported this issue together with a cluster of related Brother-firmware flaws. Rapid7's disclosure states that CVE-2024-51978 affects "695 of the 748 total models" in the disclosed bundle, spanning "689 Brother models, 46 from FUJIFILM Business Innovation, 5 from Ricoh, 2 from Toshiba Tec, and 6 from Konica Minolta" — because those vendors sell hardware built on Brother's shared printer/MFP firmware and manufacturing process under their own brands. Rapid7 reported the issue to Brother on May 3, 2024, and the coordinated public disclosure took place on June 25, 2025 (Rapid7: Multiple Brother Devices – Multiple Vulnerabilities, Fixed).
Rapid7's write-up also states that Brother confirmed this specific flaw "cannot be fully remediated in firmware, and has required a change to the manufacturing process" — meaning only newly manufactured units built after the process change ship with a non-derivable default password, while previously manufactured devices in the field still have a serial-number-derivable default password unless an administrator has manually changed it (Rapid7: Multiple Brother Devices – Multiple Vulnerabilities, Fixed).
Brother has published vendor FAQ pages listing the specific affected model numbers and guidance for each product line; administrators of Brother-firmware printers and MFPs — including Brother-branded, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta rebrands — should consult those pages to confirm whether a specific model and firmware version is affected, and in all cases should change the device's default administrator password as the practical mitigation, since doing so (per Rapid7) renders the serial-number-based password calculation moot regardless of patch status (Brother FAQ).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.1583 (96.9th percentile) as of 2026-11-07 — a markedly elevated EPSS score compared with most unexploited CVEs, reflecting the public proof-of-concept tooling (including a published Nuclei template and a Metasploit module) available for this flaw (CISA KEV, FIRST EPSS).
NVD's own severity analysis for this CVE is pending as of 2026-11-08. In the meantime, any organization running Brother-firmware printers or MFPs — under the Brother, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, or Konica Minolta brand — should check the affected-model list on the vendor FAQ pages, change the device's default administrator password if it has not already been changed, and restrict network access to the device's management interfaces.
Evidence
- An unauthenticated attacker who knows a vulnerable device's serial number can generate its default administrator password; the serial number can first be discovered via the companion flaw CVE-2024-51977 over HTTP/HTTPS/IPP, PJL, or SNMP. — NVD
- CVE-2024-51977: the unauthenticated URI path /etc/mnt_info.csv returns a CSV table leaking the device's model, firmware version, IP address, and serial number. — NVD
- NVD status is 'Deferred' with only a Rapid7-submitted Secondary CVSS v3.1 score of 9.8 (critical); no NVD-published Primary score as of this writing. — NVD
- Discovered by Stephen Fewer of Rapid7; affects 695 of 748 total models across Brother (689), FUJIFILM Business Innovation (46), Ricoh (5), Toshiba Tec (2), and Konica Minolta (6); reported to Brother May 3, 2024, publicly disclosed June 25, 2025; Brother confirmed the flaw cannot be fully remediated in firmware and required a manufacturing-process change. — Rapid7
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.1583 (96.9th percentile) as of 2026-11-07. — FIRST EPSS
Related advisories
Sources
Frequently asked questions
What is CVE-2024-51978?
CVE-2024-51978 is a critical flaw (CWE-1391, use of a weak pseudo-random number generator) in how Brother Industries manufactures printers and MFPs: every affected device's default administrator password is mathematically derived from its own serial number, so an unauthenticated attacker who learns a device's serial number can compute its default admin password and log in with full administrative control, and because NVD has not, as of 2026-11-08, published its own Primary CVSS score, this page shows only the Secondary rating the discovering researcher submitted.
How severe is CVE-2024-51978?
CVE-2024-51978 has no NVD CVSS score published as of 2026-11-10, so this page gives it no severity rating rather than assuming low or high risk.
Is CVE-2024-51978 being actively exploited?
CVE-2024-51978 is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. FIRST's EPSS model puts its probability of exploitation at 15.83%.
What is affected by CVE-2024-51978?
CVE-2024-51978 affects Brother-firmware network printers and multifunction printers (MFPs), including devices sold under the Brother brand and OEM variants rebranded by FUJIFILM Business Innovation, Ricoh, Toshiba Tec and Konica Minolta that share the same Brother-supplied firmware.
Where does this CVE-2024-51978 information come from?
This advisory is based on NVD, NVD: companion CVE-2024-51977, Rapid7: Multiple Brother Devices – Multiple Vulnerabilities, Fixed, Brother FAQ: affected models, CISA KEV, and FIRST EPSS, cited in full in the Sources section above.
Questions about this page?