Medium severity · published Feb 8, 2022
CVE-2021-20877
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw,…
4.8
CVSS
0.8%
EPSS
No
On KEV
Description
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series (MF113W/MF212W/MF217W/MF227DW/MF229DW, MF232W/MF244DW/MF247DW/MF249DW, MF264DW/MF267DW/MF269DW/MF269DW VP, and MF4570DN/MF4570DW/MF4770N/MF4880DW/MF4890DW) and imageCLASS LBP Series (LBP113W/LBP151DW/LBP162DW ) sold in the US, and iSENSYS (LBP162DW, LBP113W, LBP151DW, MF269dw, MF267dw, MF264dw, MF113w, MF249dw, MF247dw, MF244dw, MF237w, MF232w, MF229dw, MF217w, MF212w, MF4780w, and MF4890dw) and imageRUNNER (2206IF, 2204N, and 2204F) sold in Europe) allows remote attackers to inject an arbitrary script via unspecified vectors.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
22
2204f · Canon
All versions, or not specified · source: NVD
22
2204n · Canon
All versions, or not specified · source: NVD
22
2206if · Canon
All versions, or not specified · source: NVD
LB
Lbp113w · Canon
All versions, or not specified · source: NVD
LB
Lbp151dw · Canon
All versions, or not specified · source: NVD
LB
Lbp162 · Canon
All versions, or not specified · source: NVD
LB
Lbp162dw · Canon
All versions, or not specified · source: NVD
LB
Lbp162l · Canon
All versions, or not specified · source: NVD
MF
Mf113w · Canon
All versions, or not specified · source: NVD
MF
Mf212w · Canon
All versions, or not specified · source: NVD
MF
Mf217w · Canon
All versions, or not specified · source: NVD
MF
Mf222dw · Canon
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-20877
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-20877
Vendor Advisory
https://cweb.canon.jp/e-support/info/211221xss.html
Third Party Advisory
https://jvn.jp/en/jp/JVN64806328/index.html
Third Party Advisory
https://jvn.jp/jp/JVN64806328/index.html
Vendor Advisory
https://www.canon-europe.com/support/product-security-latest-news/
Vendor Advisory
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting