Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
The vulnerability (CWE-787 — out-of-bounds write) occurs during username processing in the address book during the Mobile Device feature authentication process. The attacker sends crafted network data that causes a buffer overflow in the device's memory. This can result in overwriting critical memory structures, leading to arbitrary code execution or complete loss of device responsiveness.
An attacker located in the same network segment can execute arbitrary code (RCE) on the vulnerable device or cause its permanent unavailability (DoS). Complete takeover of the device can result in breach of confidentiality, integrity, and availability.
The device firmware must be updated to a version newer than v03.07 in accordance with the manufacturer's recommendations published in the Canon PSIRT advisory (cp2024-001). Patches and instructions are available on Canon's regional websites: Japan (canon.jp), USA (usa.canon.com), and Europe (canon-europe.com). Until updates are applied, it is recommended to isolate printing devices in a dedicated network segment (VLAN) with restricted network access to trusted hosts.
Devices with firmware v03.07 and earlier: Satera LBP670C Series / Satera MF750C Series (Japan); Color imageCLASS LBP674C / Color imageCLASS X LBP1333C / Color imageCLASS MF750C Series / Color imageCLASS X MF1333C Series (USA); i-SENSYS LBP673Cdw / C1333P / i-SENSYS MF750C Series / C1333i Series (Europe) — including Canon MF755Cdw, MF753Cdw, MF751Cdw
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCanon I Sensys Lbp673cdw
HWCanonwszystkie wersjeCanon I Sensys Lbp673cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf752cdw
HWCanonwszystkie wersjeCanon I Sensys Mf752cdw Firmware
OSCanon≤ 03.07Canon I Sensys Mf754cdw
HWCanonwszystkie wersjeCanon I Sensys Mf754cdw Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i
HWCanonwszystkie wersjeCanon I Sensys X C1333if
HWCanonwszystkie wersjeCanon I Sensys X C1333if Firmware
OSCanon≤ 03.07Canon I Sensys X C1333i Firmware
OSCanon≤ 03.07Canon I Sensys X C1333p
HWCanonwszystkie wersjeCanon I Sensys X C1333p Firmware
OSCanon≤ 03.07Canon Lbp122dw
HWCanonwszystkie wersjeCanon Lbp122dw Firmware
OSCanon≤ 03.07Canon Lbp1238 Ii
HWCanonwszystkie wersjeCanon Lbp1238 Ii Firmware
OSCanon≤ 03.07Canon Lbp1333c
HWCanonwszystkie wersjeCanon Lbp1333c Firmware
OSCanon≤ 03.07Canon Lbp236dw
HWCanonwszystkie wersjeCanon Lbp236dw Firmware
OSCanon≤ 03.07Canon Lbp237dw
HWCanonwszystkie wersjeCanon Lbp237dw Firmware
OSCanon≤ 03.07Canon Lbp671c
HWCanonwszystkie wersjeCanon Lbp671c Firmware
OSCanon≤ 03.07Canon Lbp672c
HWCanonwszystkie wersjeCanon Lbp672c Firmware
OSCanon≤ 03.07Canon Lbp674c
HWCanonwszystkie wersjeCanon Lbp674cdw
HWCanonwszystkie wersjeCanon Lbp674cdw Firmware
OSCanon≤ 03.07Canon Lbp674c Firmware
OSCanon≤ 03.07
Related vulnerabilities
Buffer overflow w drukarkach Canon — RCE przez sieć lokalną
Buffer overflow w Canon — RCE przez WSD w drukarkach biurowych
Buffer overflow w przetwarzaniu XML plików XPS w drukarkach Canon
RCE przez invalid free w drukarkach Canon — luki w firmware v06.02
Buffer overflow w przetwarzaniu czcionek XPS w drukarkach Canon — RCE