Critical severity · published Mar 28, 2023
CVE-2022-24673
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers
9.8
CVSS
2.6%
EPSS
No
On KEV
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
D1520 Firmware · Canon
All versions, or not specified · source: NVD
DF
D1550 Firmware · Canon
All versions, or not specified · source: NVD
DF
D1620 Firmware · Canon
All versions, or not specified · source: NVD
DF
D1650 Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp1127c Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp1238 Firmware · Canon
All versions, or not specified · source: NVD
LI
Lbp1238 II Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp214dw Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp215dw Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp226dw Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp227dw Firmware · Canon
All versions, or not specified · source: NVD
LF
Lbp228dw Firmware · Canon
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-24673
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-24673
Vendor Advisory
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-515/
More from D1520 Firmware
8.8
CVE-2022-24674
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers
8.8
CVE-2022-24672
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers