Brother, FUJIFILM, Ricoh, Toshiba Tec, Konica Minolta Printers - Information Disclosure (CVE-2024-51977)

CVE-2024-51977 is a vulnerability in a wide range of Brother, FUJIFILM, Ricoh, Toshiba Tec, and Konica Minolta printers and multifunction devices allows unauthenticated attackers to access sensitive device information—including model, firmware version, IP address, and serial number—by sending a simple GET request to the /etc/mnt_info.csv path over HTTP, HTTPS, or IPP. This information disclosure could be leveraged by attackers for reconnaissance, targeted attacks, or to facilitate further exploitation of the affected devices within a network.

CrowdSec has been tracking this vulnerability and its exploits since 4th of July 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2024-51977 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2024-51977 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated GET requests to /etc/mnt_info.csv, exposing sensitive device information such as model, firmware version, IP address, and serial number.