Vulnerability-Lookup

JVNDB-2026-002119

Vulnerability from jvndb - Published: 2026-01-30 11:26 - Updated:2026-01-30 11:26

Severity ?

5.3 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

Multiple vulnerabilities in BROTHER MFPs (multifunction printers)

Details

Multiple MFPs provided by BROTHER INDUSTRIES, LTD. contain multiple vulnerabilities listed below.

Improper certificate validation (CWE-295) - CVE-2025-53869
Hidden Functionality (CWE-912) - CVE-2025-55704

Anton Fabricius of SySS GmbH reported these vulnerabilities to the developer. JPCERT/CC coordinated between the reporter and the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU92878805/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-53869
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-55704
	Improper Certificate Validation(CWE-295)	https://cwe.mitre.org/data/definitions/295.html
	Hidden Functionality(CWE-912)	https://cwe.mitre.org/data/definitions/912.html

Impacted products

Vendor

Product

	Brother Industries	(Multiple Products)
	Ricoh Co., Ltd	(multiple product)
	KONICA MINOLTA, INC.	(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-002119.html",
  "dc:date": "2026-01-30T11:26+09:00",
  "dcterms:issued": "2026-01-30T11:26+09:00",
  "dcterms:modified": "2026-01-30T11:26+09:00",
  "description": "Multiple MFPs provided by BROTHER INDUSTRIES, LTD. contain multiple vulnerabilities listed below.\u003cul\u003e\u003cli\u003eImproper certificate validation (CWE-295) - CVE-2025-53869\u003c/li\u003e\u003cli\u003eHidden Functionality (CWE-912) - CVE-2025-55704\u003c/li\u003e\u003c/ul\u003eAnton Fabricius of SySS GmbH reported these vulnerabilities to the developer.\r\nJPCERT/CC coordinated between the reporter and the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-002119.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:brother:multiple_products",
      "@product": "(Multiple Products)",
      "@vendor": "Brother Industries",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:ricoh:multiple_product",
      "@product": "(multiple product)",
      "@vendor": "Ricoh Co., Ltd",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/o:konicaminolta:multiple_product",
      "@product": "(Multiple Products)",
      "@vendor": "KONICA MINOLTA, INC.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "5.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-002119",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU92878805/index.html",
      "@id": "JVNVU#92878805",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-53869",
      "@id": "CVE-2025-53869",
      "@source": "CVE"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-55704",
      "@id": "CVE-2025-55704",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/295.html",
      "@id": "CWE-295",
      "@title": "Improper Certificate Validation(CWE-295)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/912.html",
      "@id": "CWE-912",
      "@title": "Hidden Functionality(CWE-912)"
    }
  ],
  "title": "Multiple vulnerabilities in BROTHER MFPs (multifunction printers)"
}

CVE-2025-55704 (GCVE-0-2025-55704)

Vulnerability from cvelistv5 – Published: 2026-01-29 02:41 – Updated: 2026-01-29 17:55

Summary

Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs.

Severity ?

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-912 - Hidden functionality

Assigner

jpcert

References

URL

Tags

	https://faq.brother.co.jp/app/answers/detail/a_id/13716
	https://www.konicaminolta.com/global-en/security/…
	https://jvn.jp/en/vu/JVNVU92878805/

Impacted products

Vendor

Product

Version

Brother Industries, Ltd.

Multiple MFPs

Affected: see the information provided by the vendor

Konica Minolta, Inc.

Multiple MFPs

Affected: see the information provided by the vendor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-55704",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T17:55:30.752261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T17:55:42.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs",
          "vendor": "Brother Industries, Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple MFPs",
          "vendor": "Konica Minolta, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product and obtain sensitive information within the logs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-912",
              "description": "Hidden functionality",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-29T02:41:30.640Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://faq.brother.co.jp/app/answers/detail/a_id/13716"
        },
        {
          "url": "https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2026-0001.pdf"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU92878805/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-55704",
    "datePublished": "2026-01-29T02:41:30.640Z",
    "dateReserved": "2025-11-18T23:31:06.243Z",
    "dateUpdated": "2026-01-29T17:55:42.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-53869 (GCVE-0-2025-53869)

Vulnerability from cvelistv5 – Published: 2026-01-29 02:40 – Updated: 2026-01-29 19:56

Summary

Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the set of root certificates used by the product with a set of arbitrary certificates.

Severity ?

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-295 - Improper certificate validation

Assigner

jpcert

References

URL

Tags

	https://faq.brother.co.jp/app/answers/detail/a_id/13716
	https://www.konicaminolta.com/global-en/security/…
	https://www.ricoh.com/products/security/vulnerabi…
	https://jvn.jp/en/vu/JVNVU92878805/

Impacted products

Vendor

Product

Version

Brother Industries, Ltd.

Multiple MFPs

Affected: see the information provided by the vendor

	Konica Minolta, Inc.	Multiple MFPs	Affected: see the information provided by the vendor
	Ricoh Company, Ltd.	Multiple MFPs	Affected: see the information provided by the vendor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-53869",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-29T19:56:17.144679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-29T19:56:34.917Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple MFPs",
          "vendor": "Brother Industries, Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple MFPs",
          "vendor": "Konica Minolta, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple MFPs",
          "vendor": "Ricoh Company, Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the set of root certificates used by the product with a set of arbitrary certificates."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper certificate validation",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-29T02:40:57.255Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://faq.brother.co.jp/app/answers/detail/a_id/13716"
        },
        {
          "url": "https://www.konicaminolta.com/global-en/security/advisory/pdf/km-2026-0001.pdf"
        },
        {
          "url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2026-000001"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU92878805/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-53869",
    "datePublished": "2026-01-29T02:40:57.255Z",
    "dateReserved": "2025-11-18T23:31:03.274Z",
    "dateUpdated": "2026-01-29T19:56:34.917Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

JVNDB-2026-002119

CVE-2025-55704 (GCVE-0-2025-55704)

CVE-2025-53869 (GCVE-0-2025-53869)

Tags

Sightings

Nomenclature