CVE-2024-51982: Printer Job Language DoS Vulnerability

CVE-2024-51982 Overview

CVE-2024-51982 is a denial-of-service vulnerability affecting network-connected printers that expose TCP port 9100. An unauthenticated attacker on the network can send a malformed Printer Job Language (PJL) command that crashes the device. The target reboots automatically, but the attacker can reissue the command to repeatedly disrupt printing services. The flaw is classified under CWE-1286: Improper Validation of Syntactic Correctness of Input. The issue was disclosed by Rapid7 as part of a coordinated multi-vendor advisory covering devices from Brother, Fujifilm, and Ricoh.

Critical Impact
An unauthenticated remote attacker can repeatedly crash affected printers by sending a single malformed PJL FORMLINES variable, denying service to all users on the network.

Affected Products

Brother network-connected printer and multifunction devices (see Brother Support FAQ)
Fujifilm network printers (see Fujifilm Security Notice)
Ricoh network printers (see Ricoh Vulnerability Announcement)

Discovery Timeline

2025-06-25 - CVE-2024-51982 published to NVD as part of the coordinated Rapid7 disclosure
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-51982

Vulnerability Analysis

The vulnerability resides in the PJL parser implementation used by the affected printer firmware. PJL is a printer control language layered above PostScript and PCL, typically accepted over the raw print service on TCP port 9100. The parser fails to validate the syntactic correctness of values assigned to the FORMLINES variable. When FORMLINES is set to a non-numeric value, the firmware enters an unrecoverable error state and crashes the device. The printer automatically reboots, but an attacker can script the request to produce a persistent denial of service. Because no authentication is required and port 9100 is commonly exposed inside enterprise networks, any attacker with network reachability can trigger the condition.

Root Cause

The root cause is improper input validation in the PJL command handler. The firmware accepts the FORMLINES variable assignment without verifying that the supplied value is an integer. The unexpected data type propagates into code that assumes a valid numeric value, leading to a fatal exception and device reset. This pattern aligns with CWE-1286, where input is parsed without enforcing its syntactic structure.

Attack Vector

Exploitation requires only network access to TCP port 9100 on the target printer. The attacker establishes a TCP connection and writes a short PJL sequence that sets the FORMLINES variable to a non-numeric string, then closes the connection. The device crashes during command processing and reboots. Replaying the request keeps the printer offline. No credentials, user interaction, or prior foothold are needed.

Verified proof-of-concept material and disclosure detail are published in the Rapid7 BrotherVulnerabilities GitHub repository and the Vulnerability Disclosure Whitepaper.

Detection Methods for CVE-2024-51982

Indicators of Compromise

Unexpected printer reboots correlated with inbound TCP connections to port 9100 from non-print-server hosts.
PJL traffic containing @PJL SET FORMLINES= followed by non-numeric values.
Repeated short-lived TCP sessions to port 9100 from a single source over a short interval.

Detection Strategies

Inspect raw print traffic on TCP/9100 with network sensors and flag PJL SET commands where the assigned value violates the expected numeric type.
Correlate printer SNMP or syslog reboot events with concurrent TCP/9100 sessions to identify reboot loops.
Alert on any TCP/9100 connections originating from user workstations or unmanaged hosts rather than designated print servers.

Monitoring Recommendations

Forward printer syslog, SNMP traps, and network flow data to a centralized analytics platform and build dashboards for printer availability and reboot frequency.
Track connection counts to TCP/9100 per source IP and trigger alerts on bursts that coincide with device downtime.
Review vendor advisories from Brother, Fujifilm, and Ricoh for additional firmware-level logging guidance.

How to Mitigate CVE-2024-51982

Immediate Actions Required

Apply the firmware updates published by the affected vendors as identified in each vendor advisory linked above.
Restrict access to TCP port 9100 with network ACLs so only authorized print servers can initiate connections.
Inventory all network-attached printers, including unmanaged devices on user VLANs, and confirm patch status.

Patch Information

Brother, Fujifilm, and Ricoh have published firmware updates and mitigation guidance for affected models. Refer to the Brother Support FAQ, Fujifilm Security Notice, and Ricoh Vulnerability Announcement for model-specific firmware versions. The Rapid7 disclosure post consolidates fix availability across vendors.

Workarounds

Disable the raw print service (TCP/9100) on devices that do not require it, and route print jobs through IPP or a hardened print server instead.
Segment printers onto a dedicated VLAN with firewall rules that block TCP/9100 from end-user subnets.
Place printers behind a print server that validates and normalizes PJL input before forwarding jobs to the device.

bash

# Example: restrict TCP/9100 access to a single print server using iptables
iptables -A FORWARD -p tcp --dport 9100 -s 10.10.20.5 -d 10.10.50.0/24 -j ACCEPT
iptables -A FORWARD -p tcp --dport 9100 -d 10.10.50.0/24 -j DROP