CVE-2024-51977: Unauthenticated Information Disclosure

CVE-2024-51977 Overview

CVE-2024-51977 is an unauthenticated information disclosure vulnerability affecting multiple printer and multi-function device (MFD) product lines from Brother, Fujifilm, Konica Minolta, Ricoh, and Toshiba Tec. An attacker with network access to the HTTP service (TCP/80), HTTPS service (TCP/443), or Internet Printing Protocol (IPP) service (TCP/631) can retrieve the /etc/mnt_info.csv resource without authentication. The returned CSV file exposes device model, firmware version, IP address, and serial number. The disclosed serial number is a key input for other vulnerabilities in the same disclosure set, notably the ability to derive the device's default administrator password.

Critical Impact
Unauthenticated network attackers can harvest device serial numbers used to compute default admin credentials on affected printers, enabling downstream authenticated attacks.

Affected Products

Brother printer and multi-function device product lines (see Brother FAQ #00100846)
Fujifilm, Konica Minolta, Ricoh, and Toshiba Tec printer models sharing the affected firmware base (see Rapid7 disclosure blog)
Devices exposing HTTP (TCP/80), HTTPS (TCP/443), or IPP (TCP/631) services

Discovery Timeline

2025-06-25 - CVE-2024-51977 published to the National Vulnerability Database
2025-06-25 - Coordinated multi-vendor advisories released by Brother, Fujifilm, Konica Minolta, Ricoh, and Toshiba Tec
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-51977

Vulnerability Analysis

The vulnerability is an information exposure flaw classified under [CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory]. The embedded web server on affected devices exposes the file /etc/mnt_info.csv through HTTP, HTTPS, and IPP listeners without enforcing any authentication or authorization check.

A GET request to this URI returns a comma-separated value table describing the device. The response body contains fields including model name, firmware revision, network IP address, and the unit's serial number. None of these values are gated behind the device's administrative login.

On its own the leak has limited direct impact. However, Rapid7's disclosure documents that the serial number is used as the seed for generating the default administrator password on affected printers. An attacker who reads mnt_info.csv can therefore compute the default admin credential offline and pivot to authenticated attacks documented in the same disclosure bundle.

Root Cause

The device firmware serves diagnostic and management metadata from a static file path accessible to any network client that can reach the print services. The web stack does not require session authentication for the /etc/mnt_info.csv endpoint, and the IPP handler exposes the same resource. The design assumes the print services are only reachable from trusted management networks, which does not hold in most real-world deployments.

Attack Vector

An unauthenticated attacker sends an HTTP GET request to /etc/mnt_info.csv on TCP port 80, 443, or 631 of the target device. The device replies with the CSV metadata. No user interaction, credentials, or preconditions are required beyond network reachability to the print services. The attack works over LAN and, where these services are exposed, across the internet. Public detection tooling exists, including a Nuclei template published by ProjectDiscovery.

Detection Methods for CVE-2024-51977

Indicators of Compromise

Inbound HTTP or HTTPS requests to the URI path /etc/mnt_info.csv from non-management source addresses
IPP (TCP/631) requests targeting /etc/mnt_info.csv originating from workstation or external subnets
HTTP 200 responses from printer IP addresses containing CSV content-type payloads with model, firmware, and serial fields
Sequential requests from a single source enumerating multiple printer IPs on port 80, 443, or 631

Detection Strategies

Deploy the public Nuclei template for CVE-2024-51977 against internal print subnets to identify vulnerable devices
Write network intrusion detection signatures matching GET requests for the string mnt_info.csv on ports 80, 443, and 631
Parse web access logs from printer management gateways for requests to the vulnerable URI
Correlate mnt_info.csv fetches with subsequent administrative logins to the same device to identify credential derivation chains

Monitoring Recommendations

Baseline the set of hosts that legitimately query printer HTTP and IPP services and alert on deviations
Forward printer and print server logs into a central data lake for retention and cross-device correlation
Monitor for scanning behavior against TCP/631 on internal networks, which is uncommon outside of asset discovery tools
Track firmware versions across the print fleet and alert on devices that remain on pre-patch releases

How to Mitigate CVE-2024-51977

Immediate Actions Required

Inventory all Brother, Fujifilm, Konica Minolta, Ricoh, and Toshiba Tec devices and cross-reference against vendor advisories
Apply firmware updates from each vendor as listed in the Brother FAQ #00100846, Fujifilm security notice, Konica Minolta advisory KM-2025-0001, Ricoh announcement ricoh-2025-000007, and Toshiba Tec bulletin
Change the default administrator password on every affected device, since the serial-based default is now considered compromised
Restrict TCP/80, TCP/443, and TCP/631 on printers to authorized management VLANs only

Patch Information

Vendor advisories published on 2025-06-25 identify firmware releases that address the disclosure. Brother notes that some device models cannot receive a firmware fix for this specific issue and instead require the mitigation described in Brother FAQ #00100620, which is to change the default administrator password. Reference the Rapid7 disclosure blog and the vulnerability disclosure whitepaper for the full model matrix.

Workarounds

Change the default administrator password on every affected printer, which neutralizes the downstream credential derivation attack even if the CSV remains readable
Place printers on a segmented management VLAN and block inbound TCP/80, TCP/443, and TCP/631 from user and guest networks
Disable IPP on devices where it is not required for business printing
Use ACLs on the printer's own network settings, where supported, to restrict management interface access to specific administrative hosts

bash

# Example network ACL to restrict printer management services
# Permit only the management subnet 10.10.50.0/24 to reach printers on ports 80, 443, 631
access-list PRINT_MGMT permit tcp 10.10.50.0/24 host <printer_ip> eq 80
access-list PRINT_MGMT permit tcp 10.10.50.0/24 host <printer_ip> eq 443
access-list PRINT_MGMT permit tcp 10.10.50.0/24 host <printer_ip> eq 631
access-list PRINT_MGMT deny   tcp any host <printer_ip> eq 80
access-list PRINT_MGMT deny   tcp any host <printer_ip> eq 443
access-list PRINT_MGMT deny   tcp any host <printer_ip> eq 631