CVE-2024-51978: Authentication bypass via default password generation affecting multiple models from Brother Industries, Ltd, Toshiba Tec, and Konica Minolta, Inc.
Vulnerability summary
CVE-2024-51978 is a critical (CVSS 9.8) Use of Weak Credentials vulnerability in brother industries, ltd ads-1250w. EPSS estimates a 15.83% chance of exploitation in the next 30 days, higher than 96.8% of scored vulnerabilities. 4 public exploits are recorded.
Timeline
- 25-06-2025PublishedVulnerability first disclosed.
- 30-03-2026Last modifiedVulnerability information updated.
Description
An unauthenticated attacker who knows the target device's serial number, can generate the default administrator password for the device. An unauthenticated attacker can first discover the target device's serial number via CVE-2024-51977 over HTTP/HTTPS/IPP, or via a PJL request, or via an SNMP request.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
15.83%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
Increase +0.30 pp
From 15.53% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
4 foundMetasploit Framework
Maturity: poc
Brothervulnerabilities
Maturity: poc
Nuclei Templates
Maturity: poc
Weaknesses
CWE · root causeAffected systems
1 vendor · 200 products · Showing 200 of 605
References
13 links- www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixedThird Party Advisory
- assets.contentstack.io/v3/…Technical Description
- www.toshibatec.com/information/20250625_02.htmlVendor Advisory