CVE-2024-51983

This is a flaw in a printer’s built-in web-facing scanning service that can make the device restart when it receives a specially formed request. It is like someone repeatedly pressing a hidden reset switch: they do not need to steal information to keep the printer unavailable.

This matters to you if you run any of these Brother printer or multifunction-printer models: hl-l8260cdn, hl-l8260cdw, hl-l8360cdw, hl-l8360cdwt, hl-l9310cdw, dcp-l8410cdw, mfc-l8610cdw, mfc-l8690cdw, mfc-l8900cdw, or mfc-l9570cdw. It is only a risk if an attacker can reach the device’s web service.

An attacker who can reach the web service can disrupt printing and scanning without signing in, so treat this as an amber-priority network exposure. There is no confirmed active exploitation, no public exploit code on record, and it is not listed in CISA’s known-exploited catalog; reduce access now while awaiting vendor guidance.

Confirm exposure by inventorying the listed Brother models and identifying whether their WS-Scan web service is reachable on HTTP TCP port 80 from guest networks, untrusted internal segments, or the internet. No fixed version or supported-version branch has been published in the available patch information, so do not assume that a routine firmware update resolves CVE-2024-51983; obtain confirmation from Brother or the device support provider before treating a firmware release as a fix.

If patching is delayed, block or tightly limit TCP port 80 access to trusted management and scanning systems, separate printers from untrusted networks, and remove any internet exposure. Rebooting a device restores service but is not a lasting workaround because the malformed request can be sent again. CISA has not added this CVE to KEV, so there is no CISA remediation due date. Monitor for unexpected reboot events and recurring printing or scanning interruptions from affected devices.

CVSS v3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The weakness is CWE-1286, involving improper validation of syntactic correctness of input. An unauthenticated attacker able to connect to the Web Services feature over HTTP TCP/80 can submit a WS-Scan SOAP request with an unexpected JobToken, causing a crash and reboot; repeated requests enable persistent DoS. CISA KEV does not list the CVE, and no public exploit code is on record. EPSS predicts a 10.1% likelihood of exploitation and is rising (95th percentile); this is predictive, not evidence of observed exploitation. Press attention is rising.