High severity · published Jun 25, 2025
CVE-2024-51979
Authenticated stack based buffer overflow affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Konica Minolta, Inc.
7.2
CVSS
1.2%
EPSS
No
On KEV
Description
An authenticated attacker may trigger a stack based buffer overflow by performing a malformed request to either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631). The malformed request will contain an empty Origin header value and a malformed Referer header value. The Referer header value will trigger a stack based buffer overflow when the host value in the Referer header is processed and is greater than 64 bytes in length.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCP-L5510DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5510DW · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5512DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5518DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5610DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5660DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L5662DN · Brother Industries, Ltd
through 1.18(J) · source: vendor
DC
DCP-L8410CDW · Brother Industries, Ltd
through ZK · source: vendor
HL
HL-EX415DW · Brother Industries, Ltd
through 1.16(G) · source: vendor
HL
HL-L5210DN · Brother Industries, Ltd
1.0 through 1.14(H) · source: vendor
HL
HL-L5210DW · Brother Industries, Ltd
1.0 through 1.14(H) · source: vendor
HL
HL-L5210DWT · Brother Industries, Ltd
through 1.14(H) · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51979
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51979
assets.contentstack.io
https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
github.com
https://github.com/sfewer-r7/BrotherVulnerabilities
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
support.brother.com
https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000
www.fujifilm.com
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html
More from DCP-L5510DN
7.5
CVE-2024-51983
Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
6.8
CVE-2024-51984
Authenticated disclosure of external service passwords via pass-back attack affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
5.3
CVE-2024-51981
Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.
5.3
CVE-2024-51980
Unauthenticated Server Side Request Forgery (SSRF) via WS-Addressing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
4.3
CVE-2025-8452
Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., Toshiba Tec, and Konica Minolta, Inc.