PT-2013-5095 · Canon · Canon Mx340+8

Publicado 2013-06-21 · Atualizado 2013-06-24 · CVE-2013-4613

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Canon MG3100 Canon MG5300 Canon MG6100 Canon MP495 Canon MX340 Canon MX870 Canon MX890 Canon MX920 Canon MX922

Description The default configuration of the administrative interface on the affected printers does not require authentication, allowing remote attackers to modify the configuration by visiting the "Advanced page". The vendor has stated that the default setting does not require a password for user convenience, but it can be changed to add a password if users have concerns about third-party access.

Recommendations For each of the affected printer models, change the default setting to add a password to require authentication for accessing the administrative interface.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4613

Produtos afetados

Canon Mg3100

Canon Mg5300

Canon Mg6100

Canon Mp495

Canon Mx340

Canon Mx870

Canon Mx890

Canon Mx920

Canon Mx922

Referências · 3

• http://mattandreko.com/2013/06/canon-y-u-no-security.html · Nota
• http://archives.neohapsis.com/archives/fulldisclosure/2013-06/0146.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4613 · Nota de Segurança