JVN#82749078
Multiple vulnerabilities in printers and scanners which implement BROTHER Web Based Management

Overview

Multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. contain multiple vulnerabilities.

Products Affected

• Printers and scanners which implement BROTHER Web Based Management

• BROTHER INDUSTRIES, LTD.
• FUJIFILM Business Innovation Corp.
• Toshiba Tec Corporation
• RICOH COMPANY, LTD.

Description

Multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRIES, LTD. contain multiple vulnerabilities listed below.

• Improper Authentication (CWE-287) - CVE-2024-21824

  CVSS v3	CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	Base Score: 5.3
  CVSS v2	AV:A/AC:M/Au:N/C:P/I:N/A:N	Base Score: 2.9

• Cross-Site Request Forgery (CWE-352) - CVE-2024-22475

  CVSS v3	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	Base Score: 4.3
  CVSS v2	AV:N/AC:H/Au:N/C:N/I:P/A:N	Base Score: 2.6

Impact

• A network-adjacent user who can access the product may impersonate an administrative user - CVE-2024-21824
• If a user views a malicious page while logged in, unintended operations may be performed - CVE-2024-22475

Solution

Update the firmware
Apply the appropriate firmware update according to the information provided by the respective vendors.

Apply the workaround
Applying the workarounds may mitigate the impact of CVE-2024-22475 vulnerability.

For the details of the updates, refer to the information provided by the respective vendors on [Vendor Status] section.