heads-up: Brother printer security issues - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 26, 2025, 02:27:20 pm
content: Media:New Vulnerabilities Expose Millions of Brother Printers to Hacking -https://www.securityweek.com/new-vulnerabilities-expose-millions-of-brother-printers-to-hacking/Researchers:Multiple Brother Devices: Multiple Vulnerabilities (FIXED) -https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/Affected:- 689 printers and scanners from Brother- 46 printers from FUJIFILM Business Innovation- 5 printers from Ricoh- 2 printers from Toshiba Tec Corporation- 6 printers from Konica MinoltaThe worst issue is an authentication bypass (CVE-2024-51978) which 'cannot be fully remediated in firmware, and has required a change to the manufacturing process of all affected models'.

author: dferyance
author_rank: Regular Contributor
timestamp: June 26, 2025, 05:51:50 pm
content: It sounds like brother addressed California's default password law by generating a unique password off the serial number since that already has to be unique and someone figured out how to capture the serial number and reverse it. It's still better than every device having the same default password and being wide open. But to remediate CVE-2024-51978 I think all you have to do is change the password. Unless it doesn't let you? Understandably many people won't, but they really should.I've gone through discussions regarding complying with the default password law before. Usually forcing the user to change it requires more engineering work (not that it is a lot, just more) than changing the production programming so I'm not surprised they took that path. I am of the opinion that it is better to force the user to change the password on first use. Even if they pick a weak password, it is still an improvement.Not that security vulnerabilities are all fine and dandy, but I have to wonder the use-case of exposing a printer beyond a very limited LAN. It sounds nice in theory to print from remote over the internet until you have to drive or fly over to pick up your print-out.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 26, 2025, 08:03:52 pm
content: Quote from: dferyance on June 26, 2025, 05:51:50 pmIt makes no sense indeed and any company with a half-decent IT dept would not allow this anyway. The problem would be more with individuals who are not necessarily aware of all that nor are savvy enough to configure their home LAN appropriately.

author: ve7xen
author_rank: Super Contributor
timestamp: June 26, 2025, 08:43:21 pm
content: Who is plugging a printer directly into the Internet in 2025? In many places it's not evenpossibleto put a device directly on the Internet in your home because of ISP CGNAT. I don't see a big risk here, in your home network you're probably not very worried about access control to your printer from the home network. In a corporate network I would really hope the default passwords were changed, and it still wouldn't be exposed to remote attackers.There needs to be some per-device default which can be reset and recovered by technical support. I don't think it's entirely unreasonable to generate this based on the serial number. I wouldn't even think it's entirely unreasonable if they provided a mechanism for users to recover their password giving the serial number.The bigger problem is leaking the serial number unauthenticated, without verifying physical access.

author: Halcyon
author_rank: Unknown
timestamp: June 27, 2025, 01:26:23 am
content: Quote from: SiliconWizard on June 26, 2025, 08:03:52 pmExactly!Quote from: ve7xen on June 26, 2025, 08:43:21 pmWhen security researchers and nerds alike talk about "being on the internet" that generally includes LANs which have access to the internet via NAT. Whilst the devices themselves don't have a public IP address (unless you use IPv6 and you're silly enough to open that up to the internet at your edge firewall), they still pose a threat (albeit, the risk is probably low). Unless you're monitoring the traffic coming from the printer, how do you know what the device itself is reaching out to? Most home routers have UPnP enabled by default, which means devices can open up any port it likes from the inside. Another risk comes from pivoting. If you have a compromised device that an attacker can access remotely, they are now essentially on your internal network and can continue compromising devices from inside your network.I know some people will be reading this thinking "I'm just a boring nobody, I don't have secrets, I don't care", but it's about more than just access to your information or data; consumer devices are routinely being targeted and compromised so that they can be used as part of a botnet, or C2 infrastructure later on.Ideally, printers, scanners etc... should be on their own VLAN with no access to the internet at all (why do they need it apart from the occasional software update?).

author: ejeffrey
author_rank: Super Contributor
timestamp: June 27, 2025, 02:04:01 am
content: Quote from: dferyance on June 26, 2025, 05:51:50 pmI think a pre-programmed unique password that's on the sticker with the model and serial number is better than a user chosen password for most IoT devices. If the product doesn't suck you probably won't be using the password very often. Maybe only during initial setup. In that case setting up a user chosen password is a waste of time, will generally be worse than the default, and users will likely forget it by the next time they have to use it anyway.

author: golden_labels
author_rank: Super Contributor
timestamp: June 27, 2025, 06:52:43 am
content: ve7xen: before you finished reading this thread, you granted access to your LAN to no less than 8 different remote entities. You have fire…what? In 2025?

author: JPortici
author_rank: Super Contributor
timestamp: June 27, 2025, 08:26:26 am
content: Quote from: SiliconWizard on June 26, 2025, 08:03:52 pmI used to be able to block internet access to every device on the network, from the router configuration page (fritzbox).A couple of month ago when i bought a new printer i went to do the same thing, and the option was gone.Router firmware was updated by the manufacturer, and they removed the functionalityAnd of all the commercial routers i ever had, this was the only one that let me have a tiny bit of control

author: dferyance
author_rank: Regular Contributor
timestamp: June 27, 2025, 12:17:03 pm
content: Quote from: ejeffrey on June 27, 2025, 02:04:01 amYes, that is a good argument. But never underestimate the ability for companies to use a terrible default... such in the case here. My objection to the pre-programmed password is that other people will know about it. In a printer maybe no big deal but I've worked with far more sensitive devices. Its not great when staff at the manufacturer has full access to your device. Essentially the pre-programmed password takes the place of having a back door. Of course all can be mitigated by changing your password.

author: madires
author_rank: Super Contributor
timestamp: June 27, 2025, 12:19:45 pm
content: Quote from: Halcyon on June 27, 2025, 01:26:23 amAbsolutely! Security researches have shown how office printers can be leveraged as gateway to infiltrate corporate networks. It's an overlooked risk. Regarding updates, I think it's more reasonable to perform them locally (manually) due to full control. Printers which need to phone home for registration/licensing or whatever subscription service are a big no-no.

author: madires
author_rank: Super Contributor
timestamp: June 27, 2025, 12:43:57 pm
content: Quote from: JPortici on June 27, 2025, 08:26:26 amIf you feel comfortable with managing firewall rules a router running OpenWrt could be an alternative. For example, a single filter rule to block forwarding from LAN to WAN for specific MACs would do the job.

author: JPortici
author_rank: Super Contributor
timestamp: June 27, 2025, 01:40:06 pm
content: Quote from: madires on June 27, 2025, 12:43:57 pmAh, i have a banana pi r3 due to arrive soon. I hoped it would arrive today, but it's going to be monday, i guess.Open WRT doesn't scare me (i did flash it on my fritzbox before, but my variant had a cursed DLS module so DLS didn't work. I'm finally eligible to upgrade to FTTH, though, that's why i finally bought new hardware.. i could have just converted the fritzbox to openWRT, sure, but the R3 was on my to buy list for a while, i am going to use it also as a private media/git/home assistant server)The point is, even though my router let me configure the firewall so that i could block internet access for any MAC i decided (and i did block it for any smart device i had at home), it seems they updated my router and removed that option. So even if the final use thinks he can protect himself, he's only one update away from losing control.

author: ve7xen
author_rank: Super Contributor
timestamp: June 27, 2025, 05:19:11 pm
content: Quote from: Halcyon on June 27, 2025, 01:26:23 amSure, the research is valuable and such devices are 'on the Internet', but they aren't generallyexposedto the Internet. Is there a parallel bug where Brother printers request UPnP or NAT-PMP to open the vulnerable ports for themselves - this is not normal behaviour for a printer? I just don't think this is practically exploitable in a reasonable threat model for a home user. Simply not having global default passwords puts Brother in the top 10% of internet-connected-device vendors. They deserve criticism and the remote serial number exposure needs to be fixed, but this vulnerability seems to be blown quite out of proportion in the reporting on it.Quote from: Halcyon on June 27, 2025, 01:26:23 amYou can keep playing this game until your printers are airgapped and you connect to them with USB only. There are lots of things that can or should be done to improve security, but for practical reasons it needs to be balanced against the threat model, likelihood of compromise, and cost of exposure. In this case youshouldhave already changed the default password, so you aren't vulnerable anyway. If you didn't, you still probably don't need to panic because the likelihood of compromise is extremely low. There are other reasons to do this of course, but it doesn't change much about the discussion around this particular vulnerability.Do folks object to setting default password based on serial number in principle? It's clearly a compromise, but perhaps it is better than generating a random password and sticking it on a label, which could be lost or damaged, or storing it somewhere at the vendor where it could get leaked, lost, or planned-obsolence-d ('sorry that model is no longer supported').

author: madires
author_rank: Super Contributor
timestamp: June 28, 2025, 01:50:05 pm
content: If you focus just on the printer security issue it's not a big deal for a SOHO network, But when you add SOHO routers with outdated firmware (and known vulnerabilities) it becomes interesting. Mirai is still a thing, for example. Security sloppiness adds up and you might become an easy target for bots.

author: madires
author_rank: Super Contributor
timestamp: July 22, 2025, 04:43:52 pm
content: Some attackers are scanning for vulnerable devices and trying to exploit them:- Brother, FUJIFILM, RICOH, Toshiba Tec, Konica Minolta Printers - Information Disclosure (CVE-2024-51977) -https://app.crowdsec.net/cti/cve-search/CVE-2024-51977The post includes a real-time graph and a list of active IP addresses.