CVE-2024-51977

CVE-2024-51977 (CWE-538) is an unauthenticated information disclosure flaw in the network services of Brother network-connected printers and multifunction devices. An attacker with network reachability to the device's HTTP (TCP 80), HTTPS (TCP 443), or IPP (TCP 631) service can send a simple GET request for the URI path /etc/mnt_info.csv, which requires no authentication. The response is a CSV table leaking the device's model, firmware version, IP address, and serial number, giving attackers useful reconnaissance data for inventorying exposed devices and planning follow-on attacks. Any organization running affected Brother network printers is exposed, especially where those services are reachable from the internet or from untrusted network segments. No public proof-of-concept or confirmed in-the-wild exploitation has been reported and the CVE is not in CISA KEV, but EPSS rates the 30-day exploitation probability at 72.6% (99th percentile), so this should be prioritized.

What to do: Apply the firmware updates published in Brother's security advisory for this issue, and verify which models you run since not all units may be affected. As an interim mitigation, ensure ports 80, 443, and 631 on printers are not reachable from the internet or untrusted VLANs, and check your devices by requesting /etc/mnt_info.csv unauthenticated to confirm they leak data.