From 7a8b8df9ca958643b7f8c7f719aa6d9063fe9297 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 18:56:15 -0500 Subject: [PATCH 1/6] Add rob's thing, and fix up cves to display GCVEs. Signed-off-by: Tod Beardsley --- content/cve.md | 78 +++- content/cves/CVE-2025-8452.md | 756 ++++++++++++++++++++++++++++++++++ 2 files changed, 830 insertions(+), 4 deletions(-) create mode 100644 content/cves/CVE-2025-8452.md diff --git a/content/cve.md b/content/cve.md index 4874999..9a1c936 100644 --- a/content/cve.md +++ b/content/cve.md @@ -1,6 +1,9 @@ --- title: CVE -aliases: ["/cve.html"] +aliases: + - /gcve + - /cve.html + - /gcve.html --- # AHA! is a Research CNA! @@ -97,12 +100,57 @@ For issues involving other parties, please see additional requirements, below. N When we publish CVEs, we will tend to use this [template], adjusted to taste. + + ### 2023 Disclosures -
+
| CVE | Meeting | Issue | | ---------------- | --------- | ------------------------------------------ | @@ -146,11 +194,31 @@ When we publish CVEs, we will tend to use this [template], adjusted to taste. | [CVE-2025-35010] | 0x00df | **Microhard Bullet-LTE/IPn4Gii AT+MNPINGTM ArgInj** |
+
+ +### 2025 Disclosures, Now With GCVE Identifiers -## Reserved CVEs +| CVE | Meeting | Issue | GCVE | +| ---------------- | --------- | ------------------------------------------ | ---- | +| [CVE-2025-8452111] | 0x00e2 | **Brother Printer Default Admin Password Exposure** | [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] | + +
+ +## Reserved GCVEs We've reserved some number of CVEs, but it's all quite secretive and sneaky to avoid the dreaded [RBP Goblins](https://cve.mitre.org/cve/cna/RBP_Policy_v1-0.pdf). We'll publish when we publish. +That said, starting in August of 2025, we've started to reserve [GCVEs](https://gcve.eu/about) for upcoming disclosures. Apparently, there are no goblins in Luxembourg! + +
+ +| Meeting | GCVE (Reserved) | +|---------|-----------------| +| 0xXXXX | GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 | + +
+ + ### Contact Any questions about the AHA! CVE program should be directed to [cve@takeonme.org](mailto:cve@takeonme.org). @@ -193,3 +261,5 @@ Vulnerabilities involving other parties must be either (1) presented at a regula [CVE-2025-35008]: {{< baseurl >}}cves/cve-2025-35008/ [CVE-2025-35009]: {{< baseurl >}}cves/cve-2025-35009/ [CVE-2025-35010]: {{< baseurl >}}cves/cve-2025-35010/ +[CVE-2025-8452]: {{< baseurl >}}cves/cve-2025-8452/ +[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 diff --git a/content/cves/CVE-2025-8452.md b/content/cves/CVE-2025-8452.md new file mode 100644 index 0000000..518f59b --- /dev/null +++ b/content/cves/CVE-2025-8452.md @@ -0,0 +1,756 @@ +--- +title: CVE-2025-8452 +aliases: + - /cves/CVE-2025-8452.html + - /gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 +--- + +# CVE-2025-8452: Brother Printer Serial Number Disclosure + +[AHA!] has discovered an issue with multi-function printer (MFP) firmware from Brother, and is issuing this disclosure in accordance with AHA!'s standard [disclosure policy] on Thursday, August 14, 2025. [CVE-2025-8452] has been assigned to this issue. + +The [GCVE](https://gcve.eu/about/) identifier for this issue is [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] + +Any questions about this disclosure should be directed to cve@takeonme.org. + +# Executive Summary + +Brother printer firmware advertises the serial number of the device over the network via the "uscan" protocol in its implementation of the eSCL specification. While serial numbers are rarely considered sensitive, in this case, the serial number can be used to derive the default administrator password of the device. Therefore, this is an instance of [CWE-538](https://cwe.mitre.org/data/definitions/538.html):  Insertion of Sensitive Information into Externally-Accessible File or Directory, and we estimate the CVSS 3.1 rating to be [4.3](https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) . + +This flaw is quite similar to [CVE-2024-51977](https://www.cve.org/CVERecord?id=CVE-2024-51977), discovered and disclosed by Stephen Fewer of Rapid7. + +# Technical Details + +Brother printers, like most other popular networked multi-fuction printers (MFPs) implement the eSCL technical standard from Mopria Alliance to communicate capabilities to printer clients. eSCL may stand for "Enhanced Scanner Communication Language," but frustratingly, the [technical specification and license agreement](https://mopria.org/spec-download) of eSCL does not expand this initialism in any formal capacity. Yay for proprietary standards. + +One item exposed over eSCL is the device serial number, which is fetchable by discovery applications which implement the `uscan` functionality of eSCL. Two important things to consider with this revelation: + +1. Serial numbers are, by themselves, rarely considered particularly sensitive. They are written down on the device itself, after all, and often used as specific identifiers. +2. While this client functionality is normally found only in clients that are specifically seeking printer capabilities, more general purpose network scanners, such as the runZero Explorer, does this by default when it encounters a multi-function printer, as seen in the screenshot below: + +Screen shot of runZero Explorer details of a printer exposing a serial number. + +That said, Brother serial numbers are not merely non-secret "usernames" in many cases, thanks to [CVE-2024-51978](https://www.cve.org/CVERecord?id=CVE-2024-51978). This vulnerability describes the case where the serial number can be used to derive the factory-set default administrator password, as demonstrated by Stephen Fewer's proof-of concept [exploit](https://github.com/sfewer-r7/BrotherVulnerabilities/blob/main/CVE-2024-51978.rb): + +
+$ ruby CVE-2024-51978.rb --printer_serial U64969G9N921376
+[+] Generated default password: m#CJr6$S
+
+ +The defense against this, of course, is to change the default administrator password of the affected device. It should go without saying, the serial number does not change. + +Brother provided this advice, via JPCERT/CC in e-mail: + +> This vulnerability only affects devices impacted by CVE-2024-51978. Additionally, it does not affect products where the administrator password has been changed. +  To reduce the risk associated with this vulnerability, change the default administrator password via Web Based Management. + +# Attacker Value + +On its own, this information leak is of little value to most attackers, thus the middling CVSS vectors. Scenarios can be concocted where a person might be surprised that their serial number has been exposed to an adversary. It is unknown if the affected printers implement [printer tracking dots](https://en.wikipedia.org/wiki/Printer_tracking_dots) to link printed documents to specific printers. If so, this vulnerability could expose at-risk individuals such as whistleblowers and victims of harassment (as well as counterfeiters and blackmailers). + +When combined with [CVE-2024-51978](https://www.cve.org/CVERecord?id=CVE-2024-51978), however, this vulnerability is the first of a two step process of discovering a local admin password. It's commendable that the default password shipped with Brother firmware does not merely set `admin:admin` is the default administrator password, but this strategy is ultimately compromised by this vulnerability. +# Credit + +This vulnerability was discovered and reported by Rob King of runZero, and is based on the work published by Stephen Fewer of Rapid7. The disclosure was coordinated by [AHA!] and [JPCERT/CC](https://www.jpcert.or.jp/english/). + +Note that the affected products listed in [CVE-2025-8452] mirror those listed in [CVE-2024-51978](https://www.cve.org/CVERecord?id=CVE-2024-51978), covering about 700 models from Brother, Konica, and Toshiba. Special thanks to Rapid7 and Brother for doing that legwork! +# Timeline + +* 2025-Jun-25 (Wed): Rapid7 and Stephen Fewer published [their advisory](https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed/). +* 2025-Jun-26 (Thu): Matthew Kienow from runZero noted the eSCL vector in a [Rapid Response](https://www.runzero.com/blog/brother-devices/). runZero reached out to Rapid7 to update CVE-2024-51977. Rapid7 advised a new CVE. +* 2025-Jun-30 (Mon): Disclosed to Brother. (Case 250630-000684) +* 2025-Jul-07 (Mon): Brother PSIRT initially determined this was not a vulnerability. +* 2025-Jul-14 (Mon): Disclosed to JPCERT/CC (Case 94025271), citing the [Nuclei template](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-51978.yaml) and [Metasploit module](https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/misc/brother_default_admin_auth_bypass_cve_2024_51978.rb) that exercise the effect of CVE-2024-51978 has on disclosed serial numbers, and the fact that the issue is already public anyway. +* 2025-Jul-29 (Tue): Informed JPCERT/CC of AHA!'s intent to disclose this issue the week after Black Hat USA (on or around August 13, 2025). +* 2025-Jul-31 (Thu): Demonstrated the vulnerability at a regular [AHA!] meeting. +* 2025-Aug-12 (Tue): JPCERT/CC noted Brother's [product advisory](https://support.brother.com/g/b/faqend.aspx?c=us&lang=en&prod=group2&faqid=faq00100851_000) which mentions [CVE-2025-8452]. The CVE was then published several hours later to avoid confusion. +* 2025-Aug-14 (Thu): Published this advisory on [CVE-2025-8452] + +---- + +[AHA!]: https://takeonme.org +[disclosure policy]: https://takeonme.org/cve.html +[CVE-2025-8452]: https://www.cve.org/CVERecord?id=CVE-2025-8452 +[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 From a58480b9ae4d031a37bcf1072971c83f11e2eaed Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 18:58:21 -0500 Subject: [PATCH 2/6] Fix up tables to show GCVEs correctly-ish. Signed-off-by: Tod Beardsley --- content/cve.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/cve.md b/content/cve.md index 9a1c936..6ab47b6 100644 --- a/content/cve.md +++ b/content/cve.md @@ -200,7 +200,7 @@ When we publish CVEs, we will tend to use this [template], adjusted to taste. | CVE | Meeting | Issue | GCVE | | ---------------- | --------- | ------------------------------------------ | ---- | -| [CVE-2025-8452111] | 0x00e2 | **Brother Printer Default Admin Password Exposure** | [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] | +| [CVE-2025-8452] | 0x00e2 | **Brother Printer Default Admin Password Exposure** | [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] |
From 815bd0255780557d587ee54c8101a3feff0073e7 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 19:06:53 -0500 Subject: [PATCH 3/6] Clear test data, fix reserved table Signed-off-by: Tod Beardsley --- content/cve.md | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/content/cve.md b/content/cve.md index 6ab47b6..936d415 100644 --- a/content/cve.md +++ b/content/cve.md @@ -136,16 +136,25 @@ When we publish CVEs, we will tend to use this [template], adjusted to taste. white-space: nowrap; } +/* Reserved Table */ + .nowrap-gcve-reserved table { - width: 125%; + width: 100%; table-layout: fixed; } -.nowrap-gcve-reserved th:last-child,td:last-child { +/* Meeting ID */ +.nowrap-gcve-reserved th:first-child,td:first-child { width: 25%; white-space: nowrap; } +/* GCVE ID */ +.nowrap-gcve-reserved th:last-child,td:last-child { + width: 75%; + white-space: nowrap; +} + ### 2023 Disclosures @@ -210,11 +219,11 @@ We've reserved some number of CVEs, but it's all quite secretive and sneaky to a That said, starting in August of 2025, we've started to reserve [GCVEs](https://gcve.eu/about) for upcoming disclosures. Apparently, there are no goblins in Luxembourg! -
+
| Meeting | GCVE (Reserved) | |---------|-----------------| -| 0xXXXX | GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 | +| 0xXXXX | None yet! | GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 |
From c039741856b7fa53673dedfd4d1b17fbce9445be Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 19:13:10 -0500 Subject: [PATCH 4/6] Fix GCVE typo Signed-off-by: Tod Beardsley --- content/cve.md | 2 +- content/cves/CVE-2025-8452.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/content/cve.md b/content/cve.md index 936d415..1b490c2 100644 --- a/content/cve.md +++ b/content/cve.md @@ -271,4 +271,4 @@ Vulnerabilities involving other parties must be either (1) presented at a regula [CVE-2025-35009]: {{< baseurl >}}cves/cve-2025-35009/ [CVE-2025-35010]: {{< baseurl >}}cves/cve-2025-35010/ [CVE-2025-8452]: {{< baseurl >}}cves/cve-2025-8452/ -[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 +[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 diff --git a/content/cves/CVE-2025-8452.md b/content/cves/CVE-2025-8452.md index 518f59b..b223bb4 100644 --- a/content/cves/CVE-2025-8452.md +++ b/content/cves/CVE-2025-8452.md @@ -753,4 +753,4 @@ Note that the affected products listed in [CVE-2025-8452] mirror those listed in [AHA!]: https://takeonme.org [disclosure policy]: https://takeonme.org/cve.html [CVE-2025-8452]: https://www.cve.org/CVERecord?id=CVE-2025-8452 -[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 +[GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001]: {{< baseurl >}}gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 From a21903ec2b6c22da53a73031662233b50e29c5e9 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 19:14:47 -0500 Subject: [PATCH 5/6] Dangitall Signed-off-by: Tod Beardsley --- content/cves/CVE-2025-8452.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/cves/CVE-2025-8452.md b/content/cves/CVE-2025-8452.md index b223bb4..f42f007 100644 --- a/content/cves/CVE-2025-8452.md +++ b/content/cves/CVE-2025-8452.md @@ -2,7 +2,7 @@ title: CVE-2025-8452 aliases: - /cves/CVE-2025-8452.html - - /gcves/GCVE-GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 + - /gcves/GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001 --- # CVE-2025-8452: Brother Printer Serial Number Disclosure From cd8b35f326f8d6d9a6ecf96ee888e102cc7091c7 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Thu, 14 Aug 2025 21:05:50 -0500 Subject: [PATCH 6/6] Harmonize the title Signed-off-by: Tod Beardsley --- content/cve.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/cve.md b/content/cve.md index 1b490c2..a191136 100644 --- a/content/cve.md +++ b/content/cve.md @@ -207,9 +207,9 @@ When we publish CVEs, we will tend to use this [template], adjusted to taste. ### 2025 Disclosures, Now With GCVE Identifiers -| CVE | Meeting | Issue | GCVE | -| ---------------- | --------- | ------------------------------------------ | ---- | -| [CVE-2025-8452] | 0x00e2 | **Brother Printer Default Admin Password Exposure** | [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] | +| CVE | Meeting | Issue | GCVE | +| ---------------- | --------- | ------------------------------------------ | ---- | +| [CVE-2025-8452] | 0x00e2 | **Brother Printer Serial Number Disclosure** | [GCVE-1337-2025-00000000000000000000000000000000000000000000000001011111011111010111111001000000000000000000000000000000000000000000000000000000001] |