An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.

Multiple BROTHER products provided by BROTHER INDUSTRIES, LTD. contain multiple vulnerabilities listed below. * Exposure of sensitive system information to an unauthorized control sphere (CWE-497) - CVE-2024-51977 * Use of weak credentials (CWE-1391) - CVE-2024-51978 * Stack-based buffer overflow (CWE-121) - CVE-2024-51979 * Server-side request forgery (CWE-918) - CVE-2024-51980, CVE-2024-51981 * Improper handling of unexpected data type (CWE-241) - CVE-2024-51982 * Improper enforcement of behavioral workflow (CWE-841) - CVE-2024-51983 * Insufficiently protected credentials (CWE-522) - CVE-2024-51984 Stephen Fewer of Rapid7 reported this vulnerability to the developer. JPCERT/CC coordinated between the reporter and the developer.