This vulnerability allows an unauthenticated attacker to perform a limited SSRF attack on Brother HL-L8260CDN devices by manipulating the WS-Addressing ReplyTo element in a SOAP request sent to the device's web service on TCP port 80. The SSRF enables the device to initiate TCP connections to arbitrary IP addresses and ports, but the attacker cannot control the payload or receive response data. This behavior can be used for internal network reconnaissance such as TCP port scanning. There is no known patch or vendor advisory specifying remediation at this time.

The impact is limited to enabling an attacker to perform internal network reconnaissance by forcing the vulnerable device to open TCP connections to arbitrary IP addresses and ports. The attacker cannot exfiltrate data or influence the content of the connections, so confidentiality, integrity, and availability impacts are minimal. This vulnerability primarily facilitates network mapping within the internal network segment where the device is accessible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's web service (TCP port 80) to trusted networks only to reduce exposure. Monitor network segmentation to prevent untrusted actors from reaching the device interface.