Critical Remote Code Execution in Canon imageCLASS MF654Cdw (CVE‑2025‑14233) Threatens Network‑Adjacent Printers

Critical Remote Code Execution in Canon imageCLASS MF654Cdw (CVE‑2025‑14233) Threatens Network‑Adjacent Printers

What It Is – A memory‑corruption flaw in the BJNP service of Canon’s imageCLASS MF654Cdw multi‑function printer enables unauthenticated attackers on the same network segment to execute arbitrary code with device‑level privileges.

Exploitability – The vulnerability is actively exploitable; proof‑of‑concept code was demonstrated at the Pwn2Own competition. CVSS 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high likelihood of remote code execution without user interaction.

Affected Products – Canon imageCLASS MF654Cdw (all firmware versions prior to the March 2026 security update).

TPRM Impact –

• Printers sit on corporate LANs and often have access to internal document repositories, making them a foothold for lateral movement.
• Compromise can lead to data exfiltration, credential theft, or deployment of ransomware across the organization’s network.
• Third‑party risk assessments that treat printers as “low‑risk” peripherals must be revisited.

Recommended Actions –

1. Verify that the latest firmware patch from Canon (released 2026‑03‑23) is applied to every MF654Cdw unit.
2. If patching cannot be performed immediately, isolate the devices on a segmented VLAN with strict outbound firewall rules.
3. Disable any unnecessary network services on the printer (e.g., BJNP, FTP, SMB).
4. Incorporate printer firmware version checks into your continuous asset‑inventory tooling.
5. Update third‑party risk questionnaires to include printer firmware management and network segmentation controls.

Source: Zero Day Initiative Advisory ZDI‑26‑222