vulnwire
9.8crit

CVE-2017-7588in critical feed1 exploit

On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attem…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
33.6%
percentile 98%
Public exploits
1
Exploit-DB

On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W.

Exploit prediction (EPSS)

33.58% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-41863 Brother MFC-J6520DW - Authentication Bypass / Password Change · webapps · 2017-04-11

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

References

  • exploit-db.com /exploits/41863/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
  • cxsecurity.com /blad/WLB-2017040064 · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.