Login Request a demo
Medium severity · published Sep 5, 2019
CVE-2019-14339
The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access
5.5
CVSS
5.4%
EPSS
No
On KEV
Description
The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data data access. This allows an attacker's malicious application to obtain sensitive information including factory passwords for the administrator web interface and WPA2-PSK key.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Print · Canon
2.5.5 · source: NVD
Affected product
PR
Print
Canon
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14339
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14339
Exploit
http://packetstormsecurity.com/files/154266/Canon-PRINT-2.5.5-URI-Injection.html
Product
https://play.google.com/store/apps/details?id=jp.co.canon.bsd.ad.pixmaprint&hl=en_US