Printer HTTP Service/IPP Service /etc/mnt_info.csv file information disclosure

Summaryinfo

A vulnerability was found in Brother Industries/FUJIFILM Business Innovation/RICOH/Toshiba Tec Printer. It has been declared as problematic. This vulnerability affects unknown code of the file /etc/mnt_info.csv of the component HTTP Service/IPP Service. Such manipulation leads to file information disclosure. This vulnerability is traded as CVE-2024-51977. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Brother Industries/FUJIFILM Business Innovation/RICOH/Toshiba Tec Printer (version now known) and classified as problematic. Affected by this issue is some unknown processing of the file /etc/mnt_info.csv of the component HTTP Service/IPP Service. The manipulation with an unknown input leads to a file information disclosure vulnerability. Using CWE to declare the problem leads to CWE-538. The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information. Impacted is confidentiality. CVE summarizes:

An unauthenticated attacker who can access either the HTTP service (TCP port 80), the HTTPS service (TCP port 443), or the IPP service (TCP port 631), can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mnt_info.csv can be accessed via a GET request and no authentication is required. The returned result is a comma separated value (CSV) table of information. The leaked information includes the device’s model, firmware version, IP address, and serial number.

The advisory is shared for download at support.brother.com. This vulnerability is handled as CVE-2024-51977 since 11/04/2024. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/25/2025). The MITRE ATT&CK project declares the attack technique as T1083.

By approaching the search of inurl:etc/mnt_info.csv it is possible to find vulnerable targets with Google Hacking. The vulnerability scanner Nessus provides a plugin with the ID 241295 (Multiple Printer Devices Information Disclosure (CVE-2024-51977)), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Tenable (241295) and EUVD (EUVD-2024-54705). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Printing Software

Vendor

• Brother Industries
• FUJIFILM Business Innovation
• RICOH
• Toshiba Tec

Name

• Printer

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion