CVE-2024-51977

Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

View on CVE.org
Published Jun 25, 2025 CVSS 3.1 · 5.3 Medium EPSS 46.6% KEV · Not listed
Description
An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.

Analysis

No analysis available yet

Remediation

No remediation available yet

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics epss

{'score': 0.41617}

 epss

{'score': 0.40748}
Type Values Removed Values Added
Metrics epss

{'score': 0.39152}

 epss

{'score': 0.41617}
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Title Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, RICOH, and Toshiba Tec. Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd., FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
References
Type Values Removed Values Added
Description An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.
Title Unauthenticated leak of sensitive information affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, RICOH, and Toshiba Tec.
Weaknesses CWE-538
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}
Earlier changes (1)

Subscriptions

No data.

Weaknesses
  • CWE-538

    Insertion of Sensitive Information into Externally-Accessible File or Directory

Sources

Status
PUBLISHED
Assigner
rapid7
Published
Updated
Mar 30, 2026, 3:47 PM
Reserved
Nov 4, 2024, 5:19 PM

View source JSON

Updated
Jun 26, 2025, 2:34 PM

JSON

Status
Deferred
Published
Jun 25, 2025, 8:15 AM
Modified
Jun 17, 2026, 8:06 AM

View source JSON

No data.

No data.