CVE-2024-51980

An unauthenticated attacker may perform a limited server side request forgery (SSRF), forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service (HTTP TCP port 80) SOAP request. The attacker can not control the data sent in the SSRF connection, nor can the attacker receive any data back. This SSRF is suitable for TCP port scanning of an internal network when the Web service (HTTP TCP port 80) is exposed across a network segment.

• CWE-918

• https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf
• https://github.com/sfewer-r7/BrotherVulnerabilities
• https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100846_000
• https://support.brother.com/g/b/link.aspx?prod=group2&faqid=faq00100848_000
• https://support.brother.com/g/b/link.aspx?prod=lmgroup1&faqid=faqp00100620_000
• https://www.fujifilm.com/fbglobal/eng/company/news/notice/2025/0625_announce.html
• https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2025-0001.pdf
• https://www.rapid7.com/blog/post/multiple-brother-devices-multiple-vulnerabilities-fixed
• https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000007
• https://www.toshibatec.com/information/20250625_02.html
• https://assets.contentstack.io/v3/assets/blte4f029e766e6b253/blt6495b3c6adf2867f/685aa980a26c5e2b1026969c/vulnerability-disclosure-whitepaper.pdf

Published

Jun 25, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51966There is a path traversal vulnerability in ESRI ArcGIS Serve…4.9
• CVE-2024-5197There exists interger overflows in libvpx in versions prior …9.1
• CVE-2024-51977An unauthenticated attacker who can access either the HTTP s…5.3
• CVE-2024-51978An unauthenticated attacker who knows the target device's se…9.8
• CVE-2024-51979An authenticated attacker may trigger a stack based buffer o…7.2
• CVE-2024-5198OpenVPN ovpn-dco for Windows version 1.1.1 allows an unprivi…3.3
• CVE-2024-51981An unauthenticated attacker may perform a blind server side …5.3
• CVE-2024-51982An unauthenticated attacker who can connect to TCP port 9100…7.5
• CVE-2024-51983An unauthenticated attacker who can connect to the Web Servi…7.5
• CVE-2024-51984An authenticated attacker can reconfigure the target device …6.8
• CVE-2024-51987Duende.AccessTokenManagement.OpenIdConnect is a set of .NET …5.4
• CVE-2024-51988RabbitMQ is a feature rich, multi-protocol messaging and str…6.5