An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00475.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

No data.

No data.

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2024-54998 An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf cve-icon cve-icon cve-icon
https://github.com/sfewer-r7/BrotherVulnerabilities cve-icon cve-icon
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000 cve-icon cve-icon
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000 cve-icon cve-icon
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html cve-icon cve-icon
https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf cve-icon cve-icon
https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed cve-icon cve-icon
https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007 cve-icon cve-icon
https://www.toshibatec.com/information/20250625_02.html cve-icon cve-icon
History

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00213}

 epss

{'score': 0.00293}

Wed, 25 Jun 2025 14:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, RICOH, and Toshiba Tec. Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.
References

Wed, 25 Jun 2025 13:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 25 Jun 2025 07:45:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.
Title Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, RICOH, and Toshiba Tec.
Weaknesses CWE-1286
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: rapid7

Published:

Updated: 2025-06-25T14:15:31.576Z

Reserved: 2024-11-04T17:19:18.809Z

Link: CVE-2024-51983

cve-icon Vulnrichment

Updated: 2025-06-25T12:27:21.678Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2025-06-25T08:15:32.873

Modified: 2025-06-26T18:58:14.280

Link: CVE-2024-51983

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.