CVE-2025-8452
BaseFortify
Publication date: 2025-08-12
Last updated on: 2025-10-08
Assigner: Austin Hackers Anonymous
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| brother | multifunction_printer | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-538 | The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability allows an attacker on the local network to retrieve the serial number of Brother multi-function printers using the eSCL/uscan protocol. With the serial number, the attacker can exploit a related vulnerability (CVE-2024-51978) to calculate the default administrator password, potentially gaining unauthorized access to the device. Changing the default administrator password mitigates this risk. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to gain unauthorized administrative access to Brother multi-function printers on the local network by calculating the default administrator password. This could lead to unauthorized control over the device, potentially impacting device security and network integrity. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by discovering the serial number of Brother multi-function printers on the local network using the eSCL protocol or SNMP. Tools that implement the eSCL specification, such as runZero Explorer, can be used to identify vulnerable devices. Specific commands are not provided, but using network discovery tools that support eSCL or SNMP queries to retrieve device serial numbers would be effective. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to change the default administrator password on the affected Brother devices via the Web Based Management interface. Changing the default password renders the vulnerability ineffective since the calculated default password will no longer be valid. [1]