Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
A buffer overflow error (CWE-787 — out-of-bounds write) occurs during address book password processing in the Mobile Device Function authentication process. An attacker on the same network segment can send specially crafted input data that overflows the buffer in the device memory. This can result in overwriting critical memory areas, leading to arbitrary code execution or device crash.
An attacker can gain full control of the vulnerable device through remote code execution (RCE) or cause it to become unavailable (denial of service). The attack does not require authentication or user interaction.
Device firmware should be updated to a version newer than v03.07, using updates provided by Canon for the appropriate region (Japan: canon.jp, USA: usa.canon.com, Europe: canon-europe.com). As additional protection, it is recommended to isolate printers in a dedicated network segment (VLAN) with access restricted only to authorized hosts.
Devices with firmware version v03.07 and earlier: Satera LBP670C / Satera MF750C series (Japan); Color imageCLASS LBP674C / Color imageCLASS X LBP1333C / Color imageCLASS MF750C Series / Color imageCLASS X MF1333C Series (USA); i-SENSYS LBP673Cdw / C1333P / i-SENSYS MF750C Series / C1333i Series (Europe), including Canon MF755Cdw, MF753Cdw, MF751Cdw.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCanon I Sensys Lbp673cdw
HWCanonwszystkie wersjeCanon I Sensys Lbp673cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf752cdw
HWCanonwszystkie wersjeCanon I Sensys Mf752cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf754cdw
HWCanonwszystkie wersjeCanon I Sensys Mf754cdw Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i
HWCanonwszystkie wersjeCanon I Sensys X C1333if
HWCanonwszystkie wersjeCanon I Sensys X C1333if Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i Firmware
OSCanon≤ 03.07Canon I Sensys X C1333p
HWCanonwszystkie wersjeCanon I Sensys X C1333p Firmware
OSCanon≤ 03.07Canon Lbp122dw
HWCanonwszystkie wersjeCanon Lbp122dw Firmware
OSCanon≤ 03.07Canon Lbp1238 Ii
HWCanonwszystkie wersjeCanon Lbp1238 Ii Firmware
OSCanon≤ 03.07Canon Lbp1333c
HWCanonwszystkie wersjeCanon Lbp1333c Firmware
OSCanon≤ 03.07Canon Lbp236dw
HWCanonwszystkie wersjeCanon Lbp236dw Firmware
OSCanon≤ 03.07Canon Lbp237dw
HWCanonwszystkie wersjeCanon Lbp237dw Firmware
OSCanon≤ 03.07Canon Lbp671c
HWCanonwszystkie wersjeCanon Lbp671c Firmware
OSCanon≤ 03.07Canon Lbp672c
HWCanonwszystkie wersjeCanon Lbp672c Firmware
OSCanon≤ 03.07Canon Lbp674c
HWCanonwszystkie wersjeCanon Lbp674cdw
HWCanonwszystkie wersjeCanon Lbp674cdw Firmware
OSCanon≤ 03.07Canon Lbp674c Firmware
OSCanon≤ 03.07
Related vulnerabilities
Buffer overflow w drukarkach Canon — RCE przez sieć lokalną
Buffer overflow w Canon — RCE przez WSD w drukarkach biurowych
Buffer overflow w przetwarzaniu XML plików XPS w drukarkach Canon
RCE przez invalid free w drukarkach Canon — luki w firmware v06.02
Buffer overflow w przetwarzaniu czcionek XPS w drukarkach Canon — RCE