Aggregates CVE and security vulnerability intelligence across all brother-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk cross-site scripting and vendor risk path handling and related problems; some flaws may lead to vendor impact application crash, affecting vendor surface production workloads scenarios.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2020-36929 | Brother BRPrint Auditor 3.0.7 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted file paths in BrAuSvc and BRPA_Agent services to inject malicious executables and escalate privileges on the system. | [email protected] | 8.5 | 0.01% | 2026-01-16 | 2026-02-09 |
| CVE-2020-36928 | Brother BRAgent 1.38 contains an unquoted service path vulnerability in the WBA_Agent_Client service running with LocalSystem privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Brother\BRAgent\ to inject and execute malicious code with elevated system permissions. | [email protected] | 8.5 | 0.01% | 2026-01-16 | 2026-02-09 |
| CVE-2023-51654 | Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC. | [email protected] | 5.5 | 0.03% | 2023-12-26 | 2024-11-21 |
| CVE-2023-29984 | Null pointer dereference vulnerability exists in multiple vendors MFPs and printers which implement Debut web server 1.2 or 1.3. Processing a specially crafted request may lead an affected product to a denial-of-service (DoS) condition. As for the affected products/models/versions, see the detailed information provided by each vendor. | [email protected] | 7.5 | 0.36% | 2023-07-11 | 2024-11-21 |
| CVE-2023-28369 | Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. This vulnerability may be exploited by the other app installed on the victim user's Android device, which may lead to displaying the settings and/or log information of the affected app as a print preview. | [email protected] | 3.3 | 0.05% | 2023-05-18 | 2025-01-22 |
| CVE-2019-13194 | Some Brother printers (such as the HL-L8360CDW v1.20) were affected by different information disclosure vulnerabilities that provided sensitive information to an unauthenticated user who visits a specific URL. | [email protected] | 7.5 | 0.55% | 2020-03-13 | 2024-11-21 |
| CVE-2019-13193 | Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a stack buffer overflow vulnerability as the web server did not parse the cookie value properly. This would allow an attacker to execute arbitrary code on the device. | [email protected] | 8.8 | 2.20% | 2020-03-13 | 2024-11-21 |
| CVE-2019-13192 | Some Brother printers (such as the HL-L8360CDW v1.20) were affected by a heap buffer overflow vulnerability as the IPP service did not parse attribute names properly. This would allow an attacker to execute arbitrary code on the device. | [email protected] | 9.8 | 3.85% | 2020-03-13 | 2024-11-21 |
| CVE-2013-2675 | Brother MFC-9970CDW 1.10 devices with Firmware L contain a Frameable response (Clickjacking) vulnerability which could allow remote attackers to obtain sensitive information. | [email protected] | 6.5 | 2.07% | 2020-02-05 | 2024-11-21 |
| CVE-2013-2676 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view private IP addresses and other sensitive information. | [email protected] | 7.5 | 1.86% | 2020-02-04 | 2024-11-21 |
| CVE-2013-2674 | Brother MFC-9970CDW 1.10 firmware L devices contain an information disclosure vulnerability which allows remote attackers to view sensitive information from referrer logs due to inadequate handling of HTTP referrer headers. | [email protected] | 7.5 | 2.27% | 2020-02-03 | 2024-11-21 |
| CVE-2013-2673 | Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access. | [email protected] | 6.8 | 0.09% | 2020-02-03 | 2024-11-21 |
| CVE-2013-2672 | Brother MFC-9970CDW devices with firmware 0D allow cleartext submission of passwords. | [email protected] | 7.5 | 0.69% | 2020-02-03 | 2024-11-21 |
| CVE-2018-11581 | Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html. | [email protected] | 4.8 | 0.28% | 2018-06-01 | 2024-11-21 |
| CVE-2017-16249 | The Debut embedded http server contains a remotely exploitable denial of service where a single malformed HTTP POST request can cause the server to hang until eventually replying (~300 seconds) with an HTTP 500 error. While the server is hung, print jobs over the network are blocked and the web interface is inaccessible. An attacker can continuously send this malformed request to keep the device inaccessible to legitimate traffic. | [email protected] | 7.5 | 67.30% | 2017-11-10 | 2026-05-13 |
| CVE-2017-12568 | Denial of Service vulnerability in Debut embedded httpd 1.20 in Brother DCP-J132W (and probably other DCP models) allows remote attackers to hang the printer (disrupting its network connection) by sending a large amount of HTTP packets. | [email protected] | 7.5 | 0.53% | 2017-08-06 | 2026-05-13 |
| CVE-2017-2244 | Cross-site request forgery (CSRF) vulnerability in MFC-J960DWN firmware ver.D and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors. | [email protected] | 8.8 | 0.09% | 2017-07-07 | 2026-05-13 |
| CVE-2017-7588 | On certain Brother devices, authorization is mishandled by including a valid AuthCookie cookie in the HTTP response to a failed login attempt. Affected models are: MFC-J6973CDW MFC-J4420DW MFC-8710DW MFC-J4620DW MFC-L8850CDW MFC-J3720 MFC-J6520DW MFC-L2740DW MFC-J5910DW MFC-J6920DW MFC-L2700DW MFC-9130CW MFC-9330CDW MFC-9340CDW MFC-J5620DW MFC-J6720DW MFC-L8600CDW MFC-L9550CDW MFC-L2720DW DCP-L2540DW DCP-L2520DW HL-3140CW HL-3170CDW HL-3180CDW HL-L8350CDW HL-L2380DW ADS-2500W ADS-1000W ADS-1500W | [email protected] | 9.8 | 16.64% | 2017-04-12 | 2026-05-13 |
| CVE-2015-1056 | Cross-site scripting (XSS) vulnerability in Brother MFC-J4410DW printer with firmware before L allows remote attackers to inject arbitrary web script or HTML via the url parameter to general/status.html and possibly other pages. | [email protected] | 4.3 | 0.36% | 2015-01-16 | 2026-05-06 |
| CVE-2013-2671 | Multiple cross-site scripting (XSS) vulnerabilities in the Brother MFC-9970CDW printer with firmware L (1.10) allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) val parameter to admin/admin_main.html; (3) id, (4) val, or (5) arbitrary parameter name (QUERY_STRING) to admin/profile_settings_net.html; or (6) kind or (7) arbitrary parameter name (QUERY_STRING) to fax/general_setup.html, a different vulnerability than CVE-2013-2507 and CVE-2013-2670. | [email protected] | 4.3 | 0.52% | 2014-03-14 | 2026-05-06 |