CVE-2025-8452VulnerabilityPublished 12 Aug 2025Updated 8 Oct 2025

CVE-2025-8452: Brother Industries DCP-L8410CDW · Insertion of Sensitive Information into Externally-Accessible File or Directory

Affects Brother Industries DCP-L8410CDWSource CVE Database V5

Mentioned vulnerabilities

Not known to be exploited · CVSS 4.3 Medium.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

4.3Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 16% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector: Adjacent
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: Low
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Adjacent: The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 12 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Brother Industries, Ltd DCP-L8410CDW	Affected =0	Fixed in–

AI-suggested

1. Immediately change the default administrator password on all Brother DCP-L8410CDW printers to a strong, unique password to invalidate the calculated default password attack vector. 2. Restrict access to printer management interfaces by implementing network segmentation and firewall rules that limit access to trusted devices and administrators only. 3. Disable or restrict the use of the eSCL 'uscan' protocol if it is not required for business operations, or monitor its usage closely. 4. Regularly audit printer configurations and network access logs to detect unauthorized access attempts. 5. Maintain an inventory of all Brother printers and verify firmware versions; monitor for vendor patches or updates addressing this vulnerability. 6. Educate IT and security teams about this vulnerability and the importance of changing default credentials on networked devices. 7. Consider deploying network intrusion detection systems (NIDS) with signatures to detect unusual eSCL protocol activity. 8. For environments with sensitive data, consider isolating printers on dedicated VLANs with strict access controls.

Description

By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brother-provided firmware. This serial number can, in turn, can be leveraged by the flaw described by CVE-2024-51978 to calculate the default administrator password. This flaw is similar to CVE-2024-51977, with the only difference being the protocol by which an attacker can use to learn the remote device's serial number. The eSCL/uscan vector is typically only exposed on the local network. Any discovery service that implements the eSCL specification can be used to exploit this vulnerability, and one such implementation is the runZero Explorer. Changing the default administrator password will render this vulnerability virtually worthless, since the calculated default administrator password would no longer be the correct password.

Impact

For European organizations, this vulnerability poses a moderate risk primarily in environments where Brother DCP-L8410CDW printers are deployed and connected to local networks without proper segmentation or access controls. An attacker gaining administrative access to a printer could manipulate device settings, intercept print jobs, or use the device as a foothold for lateral movement within the network. Confidentiality is impacted by the exposure of the serial number and potentially administrative credentials if default passwords are unchanged. While the vulnerability does not directly affect data integrity or availability, unauthorized administrative access could lead to configuration changes or denial of service. The risk is heightened in sectors with sensitive document handling such as government, finance, healthcare, and legal services. Additionally, the local network restriction limits remote exploitation but insider threats or compromised internal devices could leverage this vulnerability. The lack of known exploits reduces immediate risk but should not lead to complacency. Organizations with large deployments of Brother printers should assess their exposure and implement mitigations promptly.

Summary

CVE-2025-8452 is a vulnerability in Brother Industries, Ltd's DCP-L8410CDW multi-function printers that arises from the exposure of sensitive information via the eSCL protocol's 'uscan' feature. The eSCL (eSCL: eSCL Scan) protocol is used for network scanning and discovery services. An attacker on the local network can query the printer using the 'uscan' protocol to obtain the device's serial number. This serial number is sensitive because it can be used to derive the default administrator password through a known weakness described in CVE-2024-51978. The vulnerability is categorized under CWE-538, which involves the insertion or exposure of sensitive information in files or directories accessible externally. The flaw does not require authentication or user interaction but is limited to local network access, reducing its attack surface. The vulnerability is similar to CVE-2024-51977, differing only in the protocol vector used to obtain the serial number. Since the default administrator password can be calculated from the serial number, an attacker could gain administrative access if the default password remains unchanged. However, changing the default password effectively mitigates the vulnerability. There are no patches currently listed, and no known exploits have been reported in the wild. The CVSS v3.1 score is 4.3 (medium severity), reflecting low confidentiality impact and no impact on integrity or availability, with low attack complexity and no privileges or user interaction required.

CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory (opens in a new tab)
Base weaknessOWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)
The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
Architecture and Design · Operation · System Configuration
Do not expose file and directory information to the user.
OWASP Cheat Sheets
Error Handling (opens in a new tab)
Logging (opens in a new tab)
Authorization (opens in a new tab)
OWASP ASVS 4.0.3
V8.3.4 (opens in a new tab)
V14.3.3 (opens in a new tab)
V7.3.3 (opens in a new tab)
Attack patterns
WSDL Scanning (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 8 Oct 2025, 14:14 UTC

WeaknessesCWE-538

Technical details

References

Community reviews

Related threats