Brother vulnerabilities
23 vulnerabilities
Known vulnerabilities in Brother products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 383 products.
Products
50 of 383- Mfc 9970Cdw8 vulnerabilities
- Hl L2380Dw5 vulnerabilities
- Dcp 1610W4 vulnerabilities
- Dcp 1610We4 vulnerabilities
- Dcp 1610Wr4 vulnerabilities
- Dcp 1610Wvb4 vulnerabilities
- Dcp 1612W4 vulnerabilities
- Dcp 1612We4 vulnerabilities
- Dcp 1612Wr4 vulnerabilities
- Dcp 1612Wvb4 vulnerabilities
- Dcp 1615Nw4 vulnerabilities
- Dcp 1616Nw4 vulnerabilities
- Dcp 1617Nw4 vulnerabilities
- Dcp 1618W4 vulnerabilities
- Dcp 1622We4 vulnerabilities
- Dcp 1623We4 vulnerabilities
- Dcp 1623Wr4 vulnerabilities
- Dcp 7180Dn4 vulnerabilities
- Dcp J572Dw4 vulnerabilities
- Dcp J572N4 vulnerabilities
- Dcp J577N4 vulnerabilities
- Dcp J582N4 vulnerabilities
- Dcp J772Dw4 vulnerabilities
- Dcp J774Dw4 vulnerabilities
- Dcp J972N4 vulnerabilities
- Dcp J973N B4 vulnerabilities
- Dcp J973N W4 vulnerabilities
- Dcp J978N B4 vulnerabilities
- Dcp J978N W4 vulnerabilities
- Dcp J981N4 vulnerabilities
- Dcp J982N B4 vulnerabilities
- Dcp J982N W4 vulnerabilities
- Dcp L2520Dw4 vulnerabilities
- Dcp L2520Dwr4 vulnerabilities
- Dcp L2540Dn4 vulnerabilities
- Dcp L2540Dnr4 vulnerabilities
- Dcp L2540Dw4 vulnerabilities
- Dcp L2541Dw4 vulnerabilities
- Dcp L2560Dw4 vulnerabilities
- Dcp L2560Dwr4 vulnerabilities
- Dcp L8410Cdw4 vulnerabilities
- Dcp T510W4 vulnerabilities
- Dcp T710W4 vulnerabilities
- Hl 1210W4 vulnerabilities
- Hl 1210We4 vulnerabilities
- Hl 1210Wr4 vulnerabilities
- Hl 1210Wvb4 vulnerabilities
- Hl 1211W4 vulnerabilities
- Hl 1212W4 vulnerabilities
- Hl 1212We4 vulnerabilities
CVE-2018-11581brotherhl-l2340d_firmware+1
EPSS score1.08%
Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.CVE-2013-2670brothermfc-9970cdw_firmwareEPSS score2.04%
Cross-site scripting (XSS) vulnerability in the Brother MFC-9970CDW printer with firmware G (1.03) and L (1.10) allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name (QUERY_STRING) to admin/admin_main.html, a different vulnerability than CVE-2013-2507 and CVE-2013-2671.CVE-2013-2507brothermfc-9970cdw_firmwareEPSS score2.04%
Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware G (1.03) allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to admin/log_to_net.html or (2) kind parameter to fax/copy_settings.html, a different vulnerability than CVE-2013-2670 and CVE-2013-2671.CVE-2013-2673brothermfc-9970cdw_firmwareEPSS score0.51%
Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access.CVE-2013-2671brothermfc-9970cdw_firmwareEPSS score1.34%
Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) val parameter to admin/admin_main.html; (3) id, (4) val, or (5) arbitrary parameter name (QUERY_STRING) to admin/profile_settings_net.html; or (6) kind or (7) arbitrary parameter name (QUERY_STRING) to fax/general_setup.html, a different vulnerability than CVE-2013-2507 and CVE-2013-2670.CVE-2013-2675brothermfc-9970cdw_firmwareEPSS score2.17%
Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information.CVE-2013-2674brothermfc-9970cdw_firmwareEPSS score2.58%
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs due to inadequate handling of HTTP referrer headers.CVE-2013-2676brothermfc-9970cdw_firmwareEPSS score2.41%
Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive information.CVE-2013-2672brothermfc-9970cdw_firmwareEPSS score1.67%
Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords.CVE-2021-47985brothersapsprintEPSS score0.17%
Brother SAPSprint 7.60 contains an unquoted service path vulnerability in the SAPSprint service binary that allows local attackers to escalate privileges. Attackers can place a malicious executable in the Program Files directory path to be executed with LocalSystem privileges when the service starts automatically.CVE-2015-1056brothermfc-j4410dw_firmwareEPSS score1.90%
Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages.CVE-2020-36928brotherbragent+1EPSS score0.26%
Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions.CVE-2020-36929brotherbrprint_auditor+1EPSS score0.25%
Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system.CVE-2017-16249brotherdcp-j132w_firmwareEPSS score59.39%
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.CVE-2017-2244brother industries, ltd.mfc-j960dwn+1EPSS score0.72%
Cross-site request forgery (CSRF) vulnerability in MFC-J960DWN firmware ver.D and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.CVE-2017-7588brotherads_firmware+3EPSS score33.58%
On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W.CVE-2017-12568brotherdcp-j132w_firmwareEPSS score1.89%
Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer (disrupting its network connection) by sending a large amount of HTTP packets.CVE-2019-13192brotherads-2400n_firmware+299EPSS score3.82%
Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse attribute names properly. This would allow an attacker to execute arbitrary code on the device.CVE-2019-13194brotherads-2400n_firmware+299EPSS score1.76%
Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to an unauthenticated user who visits a specific URL.CVE-2019-13193brotherads-2400n_firmware+299EPSS score3.09%
Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device.