CVE-2024-51981

An unauthenticated attacker may perform a blind server side request forgery (SSRF), due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control all the HTTP data sent in the SSRF connection, but the attacker can not receive any data back from this connection.

Score: CVSS 3.1 5.3 Medium
Status: Deferred - cve@rapid7.com
Published: 2025-06-25
Last modified: 2026-04-07
Weaknesses: CWE-918, CWE-93

Affected products

References

https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability…
https://github.com/sfewer-r7/BrotherVulnerabilities
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000
https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html
https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf
https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007
https://www.toshibatec.com/information/20250625_02.html