Vulnerability-Lookup

JVNDB-2025-007521

Vulnerability from jvndb - Published: 2025-06-27 00:37 - Updated:2025-08-19 02:29

Severity

7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

Multiple Brother driver installers for Windows vulnerable to privilege escalation

Details

Multiple Brother driver installers for Windows contain the following vulnerability. * Files or directories accessible to external parties (CWE-552) - CVE-2025-49797 Julian Horoszkiewicz of Eviden reported this vulnerability to the developer. JPCERT/CC coordinated between the reporter and the developer.

References

Type

URL

	JVN	https://jvn.jp/en/vu/JVNVU91819309/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-49797
	Files or Directories Accessible to External Parties(CWE-552)	https://cwe.mitre.org/data/definitions/552.html

Impacted products

Vendor

Product

(Multiple Venders)

(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-007521.html",
  "dc:date": "2025-08-19T11:29+09:00",
  "dcterms:issued": "2025-06-27T09:37+09:00",
  "dcterms:modified": "2025-08-19T11:29+09:00",
  "description": "Multiple Brother driver installers for Windows contain the following vulnerability.\r\n\r\n* Files or directories accessible to external parties (CWE-552) - CVE-2025-49797\r\n\r\nJulian Horoszkiewicz of Eviden reported this vulnerability to the developer.\r\nJPCERT/CC coordinated between the reporter and the developer.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-007521.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:multiple_vendors",
    "@product": "(Multiple Products)",
    "@vendor": "(Multiple Venders)",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-007521",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU91819309/index.html",
      "@id": "JVNVU#91819309",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-49797",
      "@id": "CVE-2025-49797",
      "@source": "CVE"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/552.html",
      "@id": "CWE-552",
      "@title": "Files or Directories Accessible to External Parties(CWE-552)"
    }
  ],
  "title": "Multiple Brother driver installers for Windows vulnerable to privilege escalation"
}

CVE-2025-49797 (GCVE-0-2025-49797)

Vulnerability from cvelistv5 – Published: 2025-06-25 09:25 – Updated: 2025-08-19 06:48

Summary

Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References].

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-06-25 12:22 UTC

CWE

CWE-552 - Files or directories accessible to external parties

Assigner

jpcert jpcert root

References

4 references

URL	Tags
https://support.brother.com/g/s/security/
https://www.toshibatec.com/information/20250625_01.html
https://www.ricoh.com/products/security/vulnerabi…
https://jvn.jp/en/vu/JVNVU91819309/

Impacted products

3 products

Vendor	Product	Version
BROTHER INDUSTRIES, LTD.	Multiple driver installers for Windows	Affected: see the information provided by the vendor
Toshiba Tec Corporation	Multiple driver installers for Windows	Affected: see the information provided by the vendor
Ricoh Company, Ltd.	Multiple driver installers for Windows	Affected: see the information provided by the vendor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-49797",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-06-25T12:22:16.386782Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-06-25T12:41:07.779Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple driver installers for Windows",
          "vendor": "BROTHER INDUSTRIES, LTD.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple driver installers for Windows",
          "vendor": "Toshiba Tec Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        },
        {
          "product": "Multiple driver installers for Windows",
          "vendor": "Ricoh Company, Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under [References]."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-552",
              "description": "Files or directories accessible to external parties",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-08-19T06:48:21.242Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://support.brother.com/g/s/security/"
        },
        {
          "url": "https://www.toshibatec.com/information/20250625_01.html"
        },
        {
          "url": "https://www.ricoh.com/products/security/vulnerabilities/vul?id=ricoh-2025-000009"
        },
        {
          "url": "https://jvn.jp/en/vu/JVNVU91819309/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-49797",
    "datePublished": "2025-06-25T09:25:53.381Z",
    "dateReserved": "2025-06-11T04:48:58.284Z",
    "dateUpdated": "2025-08-19T06:48:21.242Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.