Description
An unauthenticated attacker who can connect to TCP port 9100 can issue a Printer Job Language (PJL) command that will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device. A malformed PJL variable FORMLINES is set to a non number value causing the target to crash.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Brother Industries | HL-L8260CDN | ≤ 1.65(ZH) | — |
| Brother Industries | HL-L8260CDW | ≤ 1.65(ZH) | — |
| Brother Industries | HL-L8360CDW | ≤ 1.68(ZG) | — |
| Brother Industries | HL-L8360CDWT | ≤ 1.68(ZG) | — |
| Brother Industries | HL-L9310CDW | ≤ 1.68(ZG) | — |
| Brother Industries | DCP-L8410CDW | ≤ ZK | — |
| Brother Industries | MFC-L8610CDW | ≤ ZK | — |
| Brother Industries | MFC-L8690CDW | ≤ ZK | — |
| Brother Industries | MFC-L8900CDW | ≤ ZM | — |
| Brother Industries | MFC-L9570CDW | ≤ ZM | — |
| Brother Industries | MFC-L9577CDW | ≤ ZM | — |
| Brother Industries | HL-L2325DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2350DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2351DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2352DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2357DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2370DN | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2371DN | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2372DN | ≤ 1.74(ZE) | — |
| Brother Industries | HL-2590DN | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2370DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2370DWXL | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2375DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2376DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-B2050DN | ≤ 1.74(ZE) | — |
| Brother Industries | HL-B2080DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2385DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2386DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-2595DW | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2350DWR | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2370DNR | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2375DWR | ≤ 1.74(ZE) | — |
| Brother Industries | HL-L2395DW | ≤ ZC | — |
| Brother Industries | MFC-L2730DW | ≤ ZC | — |
| Brother Industries | MFC-L2732DW | ≤ ZC | — |
| Brother Industries | MFC-L2750DW | A – ≤ ZC | — |
| Brother Industries | MFC-L2750DWXL | ≤ ZC | — |
| Brother Industries | MFC-L2751DW | ≤ ZC | — |
| Brother Industries | MFC-L2770DW | ≤ ZC | — |
| Brother Industries | MFC-L2771DW | ≤ ZC | — |
| Brother Industries | MFC-L2730DWR | ≤ ZC | — |
| Brother Industries | MFC-L2750DWR | ≤ ZC | — |
| Brother Industries | DCP-7195DW | ≤ R | — |
| Brother Industries | MFC-7895DW | ≤ R | — |
| Brother Industries | MFC-L2730DN | ≤ R | — |
| Brother Industries | HL-L2390DW | ≤ ZC | — |
| Brother Industries | DCP-L2530DW | ≤ ZC | — |
| Brother Industries | DCP-L2531DW | ≤ ZC | — |
| Brother Industries | DCP-L2532DW | ≤ ZC | — |
| Brother Industries | DCP-L2535DW | A – ≤ ZC | — |
| Brother Industries | DCP-L2537DW | ≤ ZC | — |
| Brother Industries | DCP-B7520DW | ≤ V | — |
| Brother Industries | DCP-L2550DN | ≤ ZC | — |
| Brother Industries | DCP-L2550DW | A – ≤ ZC | — |
| Brother Industries | DCP-L2551DN | ≤ ZC | — |
| Brother Industries | DCP-L2551DW | ≤ ZC | — |
| Brother Industries | DCP-L2552DN | ≤ ZC | — |
| Brother Industries | DCP-B7535DW | ≤ V | — |
| Brother Industries | MFC-L2690DW | ≤ ZC | — |
| Brother Industries | MFC-L2710DN | ≤ ZC | — |
| Brother Industries | MFC-L2712DN | ≤ ZC | — |
| Brother Industries | MFC-L2710DW | ≤ ZC | — |
| Brother Industries | MFC-L2712DW | ≤ ZC | — |
| Brother Industries | MFC-L2713DW | ≤ ZC | — |
| Brother Industries | MFC-L2715DW | ≤ ZC | — |
| Brother Industries | MFC-L2716DW | ≤ ZC | — |
| Brother Industries | MFC-L2717DW | ≤ ZC | — |
| Brother Industries | MFC-B7715DW | ≤ ZC | — |
| Brother Industries | DCP-L2530DWR | ≤ ZC | — |
| Brother Industries | DCP-L2550DNR | ≤ ZC | — |
| Brother Industries | MFC-L2710DNR | ≤ ZC | — |
| Brother Industries | MFC-L2710DWR | ≤ ZC | — |
| Brother Industries | FAX-L2710DN | ≤ R | — |
| Brother Industries | DCP-7190DN | ≤ V | — |
| Brother Industries | DCP-B7530DN | ≤ V | — |
| Brother Industries | MFC-7890DN | ≤ V | — |
| Brother Industries | MFC-B7720DN | ≤ V | — |
| Brother Industries | DCP-7090DW | ≤ M | — |
| Brother Industries | DCP-7190DW | ≤ M | — |
| Brother Industries | HL-L3210CW | ≤ 1.39(ZA) | — |
| Brother Industries | HL-L3230CDN | ≤ 1.39(ZA) | — |
| Brother Industries | HL-L3230CDW | ≤ 1.39(ZA) | — |
| Brother Industries | HL-3160CDW | ≤ 1.39(ZA) | — |
| Brother Industries | HL-L3270CDW | ≤ 1.36(ZA) | — |
| Brother Industries | HL-3190CDW | ≤ 1.36(ZA) | — |
| Brother Industries | DCP-L3510CDW | ≤ ZA | — |
| Brother Industries | DCP-L3517CDW | ≤ ZA | — |
| Brother Industries | HL-L3290CDW | ≤ ZA | — |
| Brother Industries | DCP-L3551CDW | ≤ ZA | — |
| Brother Industries | DCP-L3550CDW | ≤ ZE | — |
| Brother Industries | DCP-9030CDN | ≤ ZE | — |
| Brother Industries | MFC-L3710CDW | ≤ ZE | — |
| Brother Industries | MFC-L3730CDN | ≤ ZE | — |
| Brother Industries | MFC-9150CDN | ≤ ZE | — |
| Brother Industries | MFC-L3735CDN | ≤ ZE | — |
| Brother Industries | MFC-L3745CDW | ≤ ZE | — |
| Brother Industries | MFC-L3750CDW | ≤ ZE | — |
| Brother Industries | MFC-9350CDW | ≤ ZE | — |
| Brother Industries | MFC-L3770CDW | A – ≤ ZE | — |
| Brother Industries | DCP-T520W | ≤ 1.21(M) | — |
References
- https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000 vendor-advisory
- https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html vendor-advisory
- https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007 vendor-advisory
- https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed third-party-advisory
- https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf technical-description
- https://github.com/sfewer-r7/BrotherVulnerabilities exploit