Description
An unauthenticated attacker who can connect to the Web Services feature (HTTP TCP port 80) can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Brother Industries | HL-L8260CDN | ≤ 1.65(ZH) | — |
| Brother Industries | HL-L8260CDW | ≤ 1.65(ZH) | — |
| Brother Industries | HL-L8360CDW | ≤ 1.68(ZG) | — |
| Brother Industries | HL-L8360CDWT | ≤ 1.68(ZG) | — |
| Brother Industries | HL-L9310CDW | ≤ 1.68(ZG) | — |
| Brother Industries | DCP-L8410CDW | ≤ ZK | — |
| Brother Industries | MFC-L8610CDW | ≤ ZK | — |
| Brother Industries | MFC-L8690CDW | ≤ ZK | — |
| Brother Industries | MFC-L8900CDW | ≤ ZM | — |
| Brother Industries | MFC-L9570CDW | ≤ ZM | — |
| Brother Industries | MFC-L9577CDW | ≤ ZM | — |
| Brother Industries | HL-L5210DN | 1.0 – ≤ 1.14(H) | — |
| Brother Industries | HL-L5212DN | ≤ 1.14(H) | — |
| Brother Industries | HL-L5215DN | ≤ 1.14(H) | — |
| Brother Industries | HL-L5210DW | 1.0 – ≤ 1.14(H) | — |
| Brother Industries | HL-L5210DWT | ≤ 1.14(H) | — |
| Brother Industries | HL-L5212DW | ≤ 1.14(H) | — |
| Brother Industries | HL-L5215DW | ≤ 1.14(H) | — |
| Brother Industries | HL-L6210DW | ≤ 1.14(H) | — |
| Brother Industries | HL-L6210DWT | ≤ 1.14(H) | — |
| Brother Industries | HL-L6217DW | ≤ 1.14(H) | — |
| Brother Industries | HL-L5218DN | ≤ 1.12(F) | — |
| Brother Industries | HL-L5228DW | ≤ 1.12(F) | — |
| Brother Industries | HL-L6310DW | 1.0 – ≤ 1.16(G) | — |
| Brother Industries | HL-L6410DN | ≤ 1.16(G) | — |
| Brother Industries | HL-L6415DN | ≤ 1.16(G) | — |
| Brother Industries | HL-L6412DW | ≤ 1.16(G) | — |
| Brother Industries | HL-L6415DW | ≤ 1.16(G) | — |
| Brother Industries | HL-L6415DWT | ≤ 1.16(G) | — |
| Brother Industries | HL-L6418DW | ≤ 1.16(G) | — |
| Brother Industries | HL-EX415DW | ≤ 1.16(G) | — |
| Brother Industries | DCP-L5510DN | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5512DN | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5518DN | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5510DW | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5610DN | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5660DN | ≤ 1.18(J) | — |
| Brother Industries | DCP-L5662DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5710DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5715DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5718DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5710DW | 1.0 – ≤ 1.18(J) | — |
| Brother Industries | MFC-L5715DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5717DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5728DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5912DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L5915DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6710DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6720DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6810DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6910DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6915DN | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6912DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6915DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-EX910 | ≤ 1.18(J) | — |
| Brother Industries | MFC-EX915DW | ≤ 1.18(J) | — |
| Brother Industries | MFC-L6820DW | ≤ 1.15(H) | — |
| Brother Industries | HL-L9410CDN | ≤ 1.23(Q) | — |
| Brother Industries | HL-L9430CDN | ≤ 1.23(Q) | — |
| Brother Industries | HL-L9470CDN | ≤ 1.23(Q) | — |
| Brother Industries | HL-EX470W | ≤ 1.23(Q) | — |
| Brother Industries | MFC-L9610CDN | ≤ 1.22(S) | — |
| Brother Industries | MFC-L9630CDN | ≤ 1.22(S) | — |
| Brother Industries | MFC-L9635CDN | ≤ 1.22(S) | — |
| Brother Industries | MFC-L9670CDN | ≤ 1.22(S) | — |
| Brother Industries | MFC-EX670W | ≤ 1.22(S) | — |
| Brother Industries | HL-L8245CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L8240CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L8230CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L3295CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L3288CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L3280CDW | ≤ 1.15(L) | — |
| Brother Industries | HL-L3240CDW | ≤ 1.06(F) | — |
| Brother Industries | HL-L3220CWE | ≤ 1.06(F) | — |
| Brother Industries | HL-L3220CW | ≤ 1.06(F) | — |
| Brother Industries | HL-L3220CDW | ≤ 1.06(F) | — |
| Brother Industries | HL-L3215CW | ≤ 1.06(F) | — |
| Brother Industries | HL-L3228CDW | ≤ 1.11(J) | — |
| Brother Industries | DCP-L3555CDW | ≤ 1.19(M) | — |
| Brother Industries | DCP-L3560CDW | ≤ 1.19(M) | — |
| Brother Industries | DCP-L3568CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3720CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3740CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3740CDWE | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3755CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3760CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3765CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3768CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L3780CDW | 1.0 – ≤ 1.19(M) | — |
| Brother Industries | MFC-L8340CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L8390CDW | ≤ 1.19(M) | — |
| Brother Industries | MFC-L8395CDW | ≤ 1.19(M) | — |
| Brother Industries | HL-L3300CDW | ≤ 1.16(L) | — |
| Brother Industries | DCP-L3515CDW | ≤ 1.16(L) | — |
| Brother Industries | DCP-L3520CDW | ≤ 1.16(L) | — |
| Brother Industries | DCP-L3520CDWE | ≤ 1.16(L) | — |
| Brother Industries | DCP-L3528CDW | ≤ 1.16(L) | — |
| Brother Industries | HL-B2100D | ≤ 1.15(J) | — |
| Brother Industries | HL-B2100DB | ≤ 1.15(J) | — |
| Brother Industries | HL-B2150W | ≤ 1.15(J) | — |
References
- https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000 vendor-advisory
- https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000 vendor-advisory
- https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html vendor-advisory
- https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007 vendor-advisory
- https://www.toshibatec.com/information/20250625_02.html vendor-advisory
- https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf vendor-advisory
- https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed third-party-advisory
- https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf technical-description
- https://github.com/sfewer-r7/BrotherVulnerabilities exploit