Vulnerability in Brother Dcp-J132w
CVE-2017-16249
The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic.
EPSS: 0.594 (99.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Brother Dcp-j132w
- Brother Dcp-j132w_firmware
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, exploit, x_refsource_EXPLOIT-DB)
Frequently asked questions
- What is CVE-2017-16249?
- CVE-2017-16249 is a high-severity vulnerability in Brother Dcp-J132w. CVSS score: 7.5/10. Published 2017-11-10.
- How severe is CVE-2017-16249?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-16249 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.