Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
A buffer overflow error (CWE-787) occurs in the component responsible for retrieving PDL resources within the CPCA protocol. An attacker in the same network segment can send crafted data causing a buffer overflow in the device's memory. This can lead to overwriting critical memory areas, and consequently to arbitrary code execution (RCE) or complete device suspension.
An attacker can remotely execute arbitrary code on the vulnerable device (RCE) or cause it to become unavailable (denial of service). The attack requires no authentication or user interaction.
Devices must be updated to firmware version newer than v03.07, in accordance with the manufacturer's recommendations published in Canon security advisories (PSIRT Advisory CP2024-001). Patches are available on regional Canon support websites (Japan, USA, Europe). Additionally, it is recommended to isolate printers in a dedicated network segment and restrict access to devices only from authorized hosts.
Firmware in version v03.07 and earlier of the following Canon devices: Satera LBP670C Series / Satera MF750C Series (Japan); Color imageCLASS LBP674C / Color imageCLASS X LBP1333C / Color imageCLASS MF750C Series / Color imageCLASS X MF1333C Series (USA); i-SENSYS LBP673Cdw / C1333P / i-SENSYS MF750C Series / C1333i Series (Europe). Also affects Canon MF755Cdw, MF753Cdw, MF751Cdw.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCanon I Sensys Lbp673cdw
HWCanonwszystkie wersjeCanon I Sensys Lbp673cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf752cdw
HWCanonwszystkie wersjeCanon I Sensys Mf752cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf754cdw
HWCanonwszystkie wersjeCanon I Sensys Mf754cdw Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i
HWCanonwszystkie wersjeCanon I Sensys X C1333if
HWCanonwszystkie wersjeCanon I Sensys X C1333if Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i Firmware
OSCanon≤ 03.07Canon I Sensys X C1333p
HWCanonwszystkie wersjeCanon I Sensys X C1333p Firmware
OSCanon≤ 03.07Canon Lbp122dw
HWCanonwszystkie wersjeCanon Lbp122dw Firmware
OSCanon≤ 03.07Canon Lbp1238 Ii
HWCanonwszystkie wersjeCanon Lbp1238 Ii Firmware
OSCanon≤ 03.07Canon Lbp1333c
HWCanonwszystkie wersjeCanon Lbp1333c Firmware
OSCanon≤ 03.07Canon Lbp236dw
HWCanonwszystkie wersjeCanon Lbp236dw Firmware
OSCanon≤ 03.07Canon Lbp237dw
HWCanonwszystkie wersjeCanon Lbp237dw Firmware
OSCanon≤ 03.07Canon Lbp671c
HWCanonwszystkie wersjeCanon Lbp671c Firmware
OSCanon≤ 03.07Canon Lbp672c
HWCanonwszystkie wersjeCanon Lbp672c Firmware
OSCanon≤ 03.07Canon Lbp674c
HWCanonwszystkie wersjeCanon Lbp674cdw
HWCanonwszystkie wersjeCanon Lbp674cdw Firmware
OSCanon≤ 03.07Canon Lbp674c Firmware
OSCanon≤ 03.07
Related vulnerabilities
Buffer overflow w drukarkach Canon — RCE przez sieć lokalną
Buffer overflow w Canon — RCE przez WSD w drukarkach biurowych
Buffer overflow w przetwarzaniu XML plików XPS w drukarkach Canon
RCE przez invalid free w drukarkach Canon — luki w firmware v06.02
Buffer overflow w przetwarzaniu czcionek XPS w drukarkach Canon — RCE