Heimdall Security Logo

CVE-2025-8452

Vulnérabilité moyenne dans DCP-L8410CDW (Brother Industries, Ltd)

CVSS 4.3 · Moyenne
EPSS 0.3%
Brother Industries, Ltd•DCP-L8410CDW•Versions : 0, <=T, <=1.12(E), <=1.18(L), <=1.32, <=V, <=ZD, <=1.23(N), <=M2309191611, <=1.11(G), <=1.16(G), <=1.11(J), <=M2309191505, <=1.03(A), <=1.12(F), <=1.14(H), <=1.12(J), <=M, <=C(1.06), <=1.03(B), <=1.16(F), <=U, <=1.15(L), <=1.09(F), <=1.08(C), <=1.21(M), <=ZM, <=1.16(L), <=F, <=1.05(B), <=1.14(M), <=X, <=1.14(J), <=P(2.28), <=1.25(L), <=1.13(L), <=1.01(A), <=1.15(K), <=1.10(G), <=1.12(H), <=P, <=W, <=S, <=ZA, <=1.28, <=L, <=1.04(C), <=1.02(B), <=ZZ, <=1.06(E), <=1.15(H), <=ZK, <=Q, <=1.19(H), <=Z, <=N, <=R, <=1.04(D), <=1.20(J), <=G(1.7), <=1.16(J), <=1.25(J), <=1.20(L), <=1.13(H), <=Y, <=K, <=1.19(M), <=J, <=ZE, <=1.02(A), <=U2406280431 (Ver R), <=1.22(S), <=ZP, <=1.09(C), <=1.27(K), <=1.03(C), <=ZC, <=1.11(K), <=1.38(L), <=1.38(M), <=1.18(J)

Description

By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password would no longer be the correct password.

Gravité et risque d'exploitation

CVE-2025-8452 obtient un score CVSS de 4.3/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.25 %, ce qui la place devant 15.7 % des CVE référencées.

Que faire ?

  • Vérifiez si DCP-L8410CDW (versions 0, <=T, <=1.12(E), <=1.18(L), <=1.32, <=V, <=ZD, <=1.23(N), <=M2309191611, <=1.11(G), <=1.16(G), <=1.11(J), <=M2309191505, <=1.03(A), <=1.12(F), <=1.14(H), <=1.12(J), <=M, <=C(1.06), <=1.03(B), <=1.16(F), <=U, <=1.15(L), <=1.09(F), <=1.08(C), <=1.21(M), <=ZM, <=1.16(L), <=F, <=1.05(B), <=1.14(M), <=X, <=1.14(J), <=P(2.28), <=1.25(L), <=1.13(L), <=1.01(A), <=1.15(K), <=1.10(G), <=1.12(H), <=P, <=W, <=S, <=ZA, <=1.28, <=L, <=1.04(C), <=1.02(B), <=ZZ, <=1.06(E), <=1.15(H), <=ZK, <=Q, <=1.19(H), <=Z, <=N, <=R, <=1.04(D), <=1.20(J), <=G(1.7), <=1.16(J), <=1.25(J), <=1.20(L), <=1.13(H), <=Y, <=K, <=1.19(M), <=J, <=ZE, <=1.02(A), <=U2406280431 (Ver R), <=1.22(S), <=ZP, <=1.09(C), <=1.27(K), <=1.03(C), <=ZC, <=1.11(K), <=1.38(L), <=1.38(M), <=1.18(J)) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE