Heimdall Security Logo

CVE-2024-51980

Vulnérabilité moyenne dans HL-L8260CDN (Brother Industries, Ltd)

CVSS 5.3 · Moyenne
EPSS 1.0%
Brother Industries, Ltd•HL-L8260CDN•Versions : <=1.15, <=1.30, 0, <=T, <=1.12(E), <=G, <=M2403271743, <=1.27(W), <=1.18, <=1.18(L), <=1.32, <=V, <=2.11, <=ZD, <=1.23(N), <=M2309191611, <=H, <=1.11(G), <=1.16(G), <=1.11(J), <=1.29(J), <=M2309191505, <=1.36(ZA), <=1.06(C), <=1.03(A), A, <=1.10(F), <=1.12(F), <=1.95(ZH), <=1.14(H), <=1.12(J), <=N2403271808, <=M, <=1.03(B), <=1.16(F), <=1.27, <=U, <=1.15(L), <=1.09(F), <=1.21(M), <=1.08(C), <=1.39(ZA), <=2.19, <=ZM, <=1.16(L), <=F, <=1.05(B), <=1.14(M), <=X, <=1.14(J), <=1.07(G), <=1.15(J), <=1.25(L), <=1.74(ZE), <=1.13(L), <=1.01(A), <=1.15(K), <=1.10(G), <=P, <=1.24, <=1.40(R), <=W, <=S, <=ZA, <=1.28, <=L, <=1.38, <=1.04(C), <=1.10, <=1.02(B), <=ZZ, <=1.06(E), <=1.15(H), <=E, <=1.21, <=ZK, <=1.03D(D), <=Q, <=1.68(ZG), <=1.19(H), <=Z, <=N, <=1.19, <=R, <=1.33, <=1.04(D), <=1.20(J), <=1.16(J), <=1.23(Q), <=1.25(J), <=1.20(L), <=1.13(H), <=Y, <=1.22(T), <=K, <=1.12, <=1.12（H）, <=1.25(W), <=1.36(Z), <=1.06(F), <=1.44, <=1.03, <=1.08, <=1.19(M), <=J, <=ZE, <=1.13(E), <=1.16(H), <=1.82(ZG), <=1.02(A), <=U2406280431 (Ver R), <=1.22(S), 1.0, <=ZP, <=1.22, <=1.65(ZH), <=1.09(C), <=1.05, <=1.27(K), <=1.03(C), <=ZC, <=1.11(K), <=1.38(L), <=1.38(M), <=1.18(J), <=ZB

Description

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.

Gravité et risque d'exploitation

CVE-2024-51980 obtient un score CVSS de 5.3/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 1.02 %, ce qui la place devant 63.0 % des CVE référencées.

Que faire ?

  • Vérifiez si HL-L8260CDN (versions <=1.15, <=1.30, 0, <=T, <=1.12(E), <=G, <=M2403271743, <=1.27(W), <=1.18, <=1.18(L), <=1.32, <=V, <=2.11, <=ZD, <=1.23(N), <=M2309191611, <=H, <=1.11(G), <=1.16(G), <=1.11(J), <=1.29(J), <=M2309191505, <=1.36(ZA), <=1.06(C), <=1.03(A), A, <=1.10(F), <=1.12(F), <=1.95(ZH), <=1.14(H), <=1.12(J), <=N2403271808, <=M, <=1.03(B), <=1.16(F), <=1.27, <=U, <=1.15(L), <=1.09(F), <=1.21(M), <=1.08(C), <=1.39(ZA), <=2.19, <=ZM, <=1.16(L), <=F, <=1.05(B), <=1.14(M), <=X, <=1.14(J), <=1.07(G), <=1.15(J), <=1.25(L), <=1.74(ZE), <=1.13(L), <=1.01(A), <=1.15(K), <=1.10(G), <=P, <=1.24, <=1.40(R), <=W, <=S, <=ZA, <=1.28, <=L, <=1.38, <=1.04(C), <=1.10, <=1.02(B), <=ZZ, <=1.06(E), <=1.15(H), <=E, <=1.21, <=ZK, <=1.03D(D), <=Q, <=1.68(ZG), <=1.19(H), <=Z, <=N, <=1.19, <=R, <=1.33, <=1.04(D), <=1.20(J), <=1.16(J), <=1.23(Q), <=1.25(J), <=1.20(L), <=1.13(H), <=Y, <=1.22(T), <=K, <=1.12, <=1.12（H）, <=1.25(W), <=1.36(Z), <=1.06(F), <=1.44, <=1.03, <=1.08, <=1.19(M), <=J, <=ZE, <=1.13(E), <=1.16(H), <=1.82(ZG), <=1.02(A), <=U2406280431 (Ver R), <=1.22(S), 1.0, <=ZP, <=1.22, <=1.65(ZH), <=1.09(C), <=1.05, <=1.27(K), <=1.03(C), <=ZC, <=1.11(K), <=1.38(L), <=1.38(M), <=1.18(J), <=ZB) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE