CVE-2024-51978

Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.

View on CVE.org
Published Jun 25, 2025 CVSS 3.1 · 9.8 Critical EPSS 15.8% KEV · Not listed
Description
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics epss

{'score': 0.7188}

 epss

{'score': 0.46351}
Type Values Removed Values Added
Title Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, and Toshiba Tec. Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
Title Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, and Toshiba Tec.
Weaknesses CWE-1391
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
rapid7
Published
Updated
Mar 30, 2026, 6:04 PM
Reserved
Nov 4, 2024, 5:19 PM

View source JSON

Updated
Jun 27, 2025, 1:51 PM

JSON

Status
Deferred
Published
Jun 25, 2025, 8:15 AM
Modified
Jun 17, 2026, 8:06 AM

View source JSON

No data.

No data.