Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
An attacker sends a specially crafted WSD (Web Services on Devices) probe request to a vulnerable device accessible on the local network. Improper handling of this request causes a buffer overflow (CWE-787 — write outside the boundaries of allocated memory area). As a result, the attacker can overwrite critical data structures in the device's memory, leading to hijacking of the execution flow or device failure.
An attacker can execute arbitrary code (RCE) on the vulnerable device without any authentication, which may lead to complete takeover of the printer, data leakage of processed information, or permanent disabling of the device (denial of service).
The device firmware should be updated to a version newer than v03.07, downloading patches from the manufacturer's support pages appropriate for the region (Japan: canon.jp, USA: usa.canon.com, Europe: canon-europe.com). As additional protection, it is recommended to isolate printing devices in a dedicated network segment (VLAN) and restrict access to them only for authorized hosts using firewall rules. Patches available from the manufacturer should be applied in accordance with the references.
Firmware version v03.07 and earlier for the following product lines: Satera LBP670C Series / Satera MF750C Series (Japan); Color imageCLASS LBP674C / Color imageCLASS X LBP1333C / Color imageCLASS MF750C Series / Color imageCLASS X MF1333C Series (USA); i-SENSYS LBP673Cdw / C1333P / i-SENSYS MF750C Series / C1333i Series (Europe). Also affects Canon models MF755Cdw, MF753Cdw, MF751Cdw.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCanon I Sensys Lbp673cdw
HWCanonwszystkie wersjeCanon I Sensys Lbp673cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf752cdw
HWCanonwszystkie wersjeCanon I Sensys Mf752cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf754cdw
HWCanonwszystkie wersjeCanon I Sensys Mf754cdw Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i
HWCanonwszystkie wersjeCanon I Sensys X C1333if
HWCanonwszystkie wersjeCanon I Sensys X C1333if Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i Firmware
OSCanon≤ 03.07Canon I Sensys X C1333p
HWCanonwszystkie wersjeCanon I Sensys X C1333p Firmware
OSCanon≤ 03.07Canon Lbp122dw
HWCanonwszystkie wersjeCanon Lbp122dw Firmware
OSCanon≤ 03.07Canon Lbp1238 Ii
HWCanonwszystkie wersjeCanon Lbp1238 Ii Firmware
OSCanon≤ 03.07Canon Lbp1333c
HWCanonwszystkie wersjeCanon Lbp1333c Firmware
OSCanon≤ 03.07Canon Lbp236dw
HWCanonwszystkie wersjeCanon Lbp236dw Firmware
OSCanon≤ 03.07Canon Lbp237dw
HWCanonwszystkie wersjeCanon Lbp237dw Firmware
OSCanon≤ 03.07Canon Lbp671c
HWCanonwszystkie wersjeCanon Lbp671c Firmware
OSCanon≤ 03.07Canon Lbp672c
HWCanonwszystkie wersjeCanon Lbp672c Firmware
OSCanon≤ 03.07Canon Lbp674c
HWCanonwszystkie wersjeCanon Lbp674cdw
HWCanonwszystkie wersjeCanon Lbp674cdw Firmware
OSCanon≤ 03.07Canon Lbp674c Firmware
OSCanon≤ 03.07
Related vulnerabilities
Buffer overflow w drukarkach Canon — RCE przez sieć lokalną
Buffer overflow w Canon — RCE przez WSD w drukarkach biurowych
Buffer overflow w przetwarzaniu XML plików XPS w drukarkach Canon
RCE przez invalid free w drukarkach Canon — luki w firmware v06.02
Buffer overflow w przetwarzaniu czcionek XPS w drukarkach Canon — RCE