HL-L8260CDN - Authentication Bypass (CVE-2024-51978)

CVE-2024-51978 is a critical vulnerability affecting a wide range of Brother, Toshiba Tec, and Konica Minolta printers and multifunction devices, where an unauthenticated attacker who knows the device's serial number can generate the default administrator password. By leveraging this flaw—potentially in combination with CVE-2024-51977 to obtain the serial number—attackers can gain full administrative access remotely, leading to complete compromise of the device, exposure of sensitive data, and the ability to alter device settings or disrupt operations. This vulnerability poses a significant risk for unauthorized control and lateral movement within enterprise networks.

CrowdSec has been tracking this vulnerability and its exploits since 5th of August 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2024-51978 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2024-51978 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit Brother printers by accessing /etc/mnt_info.csv or /general/status.html to leak the device's serial number and perform authentication bypass using a generated default admin password. These endpoints are targeted for unauthorized access and login attempts.