CVE-2024-51983

Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

Exploitation likely. EPSS gives it a 10% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.17.5High EPSS percentile95th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2025-06-25Updated 2025-06-26Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you use hl-l8260cdn, hl-l8260cdw, hl-l8360cdw, hl-l8360cdwt, hl-l9310cdw, dcp-l8410cdw, mfc-l8610cdw, mfc-l8690cdw, mfc-l8900cdw, or mfc-l9570cdw.
Restrict access to the printer’s web service on port 80 so only trusted internal systems can reach it; do not expose it to the internet.
Ask Brother or your printer support provider for a security update for CVE-2024-51983; no fixed version has been published in the available information.
Watch for unexplained printer reboots or repeated loss of printing and scanning service.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.

In plain language

Written by AI from the record

If you use one of the listed Brother printer models, someone who can reach its web service can repeatedly take it offline; typical small businesses should restrict access and ask their vendor for a fix.

Unauthenticated network DoS in the WS-Scan SOAP service: an unexpected JobToken in a malformed request crashes and reboots the device, enabling repeated service disruption.

If you're affected

Printing outages
Scanning unavailable
Repeated device reboots
Office workflow disruption

What is it

This is a flaw in a printer’s built-in web-facing scanning service that can make the device restart when it receives a specially formed request. It is like someone repeatedly pressing a hidden reset switch: they do not need to steal information to keep the printer unavailable.

Who is affected

This matters to you if you run any of these Brother printer or multifunction-printer models: hl-l8260cdn, hl-l8260cdw, hl-l8360cdw, hl-l8360cdwt, hl-l9310cdw, dcp-l8410cdw, mfc-l8610cdw, mfc-l8690cdw, mfc-l8900cdw, or mfc-l9570cdw. It is only a risk if an attacker can reach the device’s web service.

How urgent is it

An attacker who can reach the web service can disrupt printing and scanning without signing in, so treat this as an amber-priority network exposure. There is no confirmed active exploitation, no public exploit code on record, and it is not listed in CISA’s known-exploited catalog; reduce access now while awaiting vendor guidance.

What to do — in detail

Confirm exposure by inventorying the listed Brother models and identifying whether their WS-Scan web service is reachable on HTTP TCP port 80 from guest networks, untrusted internal segments, or the internet. No fixed version or supported-version branch has been published in the available patch information, so do not assume that a routine firmware update resolves CVE-2024-51983; obtain confirmation from Brother or the device support provider before treating a firmware release as a fix.

If patching is delayed, block or tightly limit TCP port 80 access to trusted management and scanning systems, separate printers from untrusted networks, and remove any internet exposure. Rebooting a device restores service but is not a lasting workaround because the malformed request can be sent again. CISA has not added this CVE to KEV, so there is no CISA remediation due date. Monitor for unexpected reboot events and recurring printing or scanning interruptions from affected devices.

Technical context

CVSS v3.1 is 7.5 High (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The weakness is CWE-1286, involving improper validation of syntactic correctness of input. An unauthenticated attacker able to connect to the Web Services feature over HTTP TCP/80 can submit a WS-Scan SOAP request with an unexpected JobToken, causing a crash and reboot; repeated requests enable persistent DoS. CISA KEV does not list the CVE, and no public exploit code is on record. EPSS predicts a 10.1% likelihood of exploitation and is rising (95th percentile); this is predictive, not evidence of observed exploitation. Press attention is rising.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 447 days, from the signal feeds we watch.

2026-09-15EPSS band change0 → moderateepss band change
2025-06-26Record updated
2025-06-25Publishedweakness classified

Affected products

Brother Industries, Ltdcommercial · JPaka brother

And 704 more affected products. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

CWE-1286No name in the record

Sources

References in the record

And 6 more references. See all after sign-in

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for HL-L8260CDN, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account