SSRF in Brother Industries, Ltd Ads-2400n
CVE-2024-51980
An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.
Vulnerability class: SSRF (Server-Side Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.010 (62.1th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 62nd percentile — 62.1% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.010 · change: +0.001
Affected products
- Brother Industries, Ltd Ads-2400n — versions 0
- Brother Industries, Ltd Ads-2800w — versions 0
- Brother Industries, Ltd Ads-3000n — versions 0
- Brother Industries, Ltd Ads-3600w — versions 0
- Brother Industries, Ltd Dcp-1610w — versions 0
- Brother Industries, Ltd Dcp-1610we — versions 0
- Brother Industries, Ltd Dcp-1610wr — versions 0
- Brother Industries, Ltd Dcp-1612w — versions 0
- Brother Industries, Ltd Dcp-1612we — versions 0
- Brother Industries, Ltd Dcp-1612wr — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- support.brother.com/g/b/link.aspx (vendor-advisory)
- support.brother.com/g/b/link.aspx (vendor-advisory)
- support.brother.com/g/b/link.aspx (vendor-advisory)
- www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html (vendor-advisory)
- www.ricoh.com/products/security/vulnerabilities/vul (vendor-advisory)
- www.toshibatec.com/information/20250625_02.html (vendor-advisory)
- www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf (vendor-advisory)
- www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed (third-party-advisory)
- assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa9… (technical-description)
- github.com/sfewer-r7/BrotherVulnerabilities (exploit)
Frequently asked questions
- What is CVE-2024-51980?
- CVE-2024-51980 is a medium-severity vulnerability in Brother Industries, Ltd Ads-2400n, classified under Server-Side Request Forgery (SSRF). CVSS score: 5.3/10. Published 2025-06-25.
- How severe is CVE-2024-51980?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2024-51980 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.