Multiple vulnerabilities in Canon USA Office/Small Office Multifunction Printers, Laser Printers and Inkjet Printers



Published: 2023-05-24
Risk High
Patch available YES
Number of vulnerabilities 11
CVE-ID CVE-2023-0851
CVE-2023-0854
CVE-2023-0852
CVE-2023-0853
CVE-2023-0855
CVE-2023-0856
CVE-2022-43974
CVE-2022-43608
CVE-2023-0857
CVE-2023-0858
CVE-2023-0859
CWE-ID CWE-122
CWE-121
CWE-190
CWE-286
CWE-284
CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		imageCLASS MF1127C
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF262DW II
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF264DW II
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF267DW II
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF269DW II
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF269DW VP II
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF272DW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF273DW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF275DW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF641CW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF642CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF644CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF741CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF743CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF745CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS MF746CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS LBP122DW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS LBP1127C
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS LBP622CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS LBP623CDW
Hardware solutions / Office equipment, IP-phones, print servers

imageCLASS LBP664CDW
Hardware solutions / Office equipment, IP-phones, print servers

imagePROGRAF TC-20
Hardware solutions / Office equipment, IP-phones, print servers

imagePROGRAF TC-20M
Hardware solutions / Office equipment, IP-phones, print servers

PIXMA G3270
Hardware solutions / Office equipment, IP-phones, print servers

PIXMA G4270
Hardware solutions / Office equipment, IP-phones, print servers

MAXIFY GX3020
Hardware solutions / Office equipment, IP-phones, print servers

MAXIFY GX4020
Hardware solutions / Office equipment, IP-phones, print servers

Vendor Canon U.S.A.

Security Bulletin

This security bulletin contains information about 11 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU76467

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0851

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU76468

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0854

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Stack-based buffer overflow

EUVDB-ID: #VU76469

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0852

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Stack-based buffer overflow

EUVDB-ID: #VU76470

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0853

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Stack-based buffer overflow

EUVDB-ID: #VU76471

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0855

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stack-based buffer overflow

EUVDB-ID: #VU76472

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0856

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Integer overflow

EUVDB-ID: #VU76473

Risk: High

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-43974

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Integer overflow

EUVDB-ID: #VU76475

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-43608

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow. A remote attacker on the local network can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Incorrect User Management

EUVDB-ID: #VU76476

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0857

CWE-ID: CWE-286 - Incorrect User Management

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect user management. A remote attacker can change the product's settings or gain unauthorized access to the product.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper access control

EUVDB-ID: #VU76478

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0858

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the product.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Input validation error

EUVDB-ID: #VU76480

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0859

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote administrator can pass specially crafted input to the application and install an arbitrary file on the product.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

imageCLASS MF1127C: All versions

imageCLASS MF262DW II: All versions

imageCLASS MF264DW II: All versions

imageCLASS MF267DW II: All versions

imageCLASS MF269DW II: All versions

imageCLASS MF269DW VP II: All versions

imageCLASS MF272DW: All versions

imageCLASS MF273DW: All versions

imageCLASS MF275DW: All versions

imageCLASS MF641CW: All versions

imageCLASS MF642CDW: All versions

imageCLASS MF644CDW: All versions

imageCLASS MF741CDW: All versions

imageCLASS MF743CDW: All versions

imageCLASS MF745CDW: All versions

imageCLASS MF746CDW: All versions

imageCLASS LBP122DW: All versions

imageCLASS LBP1127C: All versions

imageCLASS LBP622CDW: All versions

imageCLASS LBP623CDW: All versions

imageCLASS LBP664CDW: All versions

imagePROGRAF TC-20: All versions

imagePROGRAF TC-20M: All versions

PIXMA G3270: All versions

PIXMA G4270: All versions

MAXIFY GX3020: All versions

MAXIFY GX4020: All versions

External links

http://jvn.jp/en/vu/JVNVU94777298/index.html
http://psirt.canon/advisory-information/cp2023-001/
http://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediatio...


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###