CVE-2024-51977

Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

5.3 MediumPublic exploit

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

46.6%Up 46.6 points since Jun 25, 2025

What each source reports

CVE List Score used 5.3

Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

Record: CVE-2024-51977
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-538
Updated: 2026-11-02

EUVDEUVD-2024-54705 5.3

Record: EUVD-2024-54705
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-27h4-8c24-mx7w 5.3

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS...

Record: GHSA-27h4-8c24-mx7w
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-538
Updated: 2026-11-02

NVD 5.3

Record: CVE-2024-51977
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-538
Updated: 2026-11-02

Affected products

Show 439 moreShow less

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Multiple Brother devices authentication bypass via default administrator password generation	2025-06-25
Nuclei	Brother MFC-L9570CDW - Information Disclosure
PoC in GitHub	sfewer-r7/BrotherVulnerabilities	2025-05-22

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, Metasploit, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-51977 is a medium vulnerability (CVSS 5.3) in Brother Industries, Ltd Dcp-1610w, published June 25, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 46.6%, the 98th percentile. No source names a fixed version.

References

Show 7 moreShow less