PT-2023-16565 · Canon · Canon Satera Mf640C Series+13

Alex Rubin + 1 · Publicado 2023-05-11 · Atualizado 2023-05-30 · CVE-2023-0858

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Canon Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series versions 11.04 and earlier Canon Color imageCLASS LBP660C Series/LBP620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C versions 11.04 and earlier Canon i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series/C1127P/C1127iF/C1127i versions 11.04 and earlier

Description The issue is related to improper authentication of the RemoteUI in certain Canon office and small office multifunction printers and laser printers. This may allow an attacker on the network segment to trigger unauthorized access to the product.

Recommendations For Canon Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series versions 11.04 and earlier, update the firmware to a version later than 11.04. For Canon Color imageCLASS LBP660C Series/LBP620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C versions 11.04 and earlier, update the firmware to a version later than 11.04. For Canon i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series/C1127P/C1127iF/C1127i versions 11.04 and earlier, update the firmware to a version later than 11.04. As a temporary workaround, consider restricting access to the RemoteUI until a patch is available.

Correção

Improper Authentication

Improper Access Control

Enumeração de Fraquezas

CWE-287

CWE-284

Identificadores relacionados

CVE-2023-0858

Produtos afetados

Color Imageclass Lbp620C Series

Color Imageclass Lbp660C Series

Color Imageclass Mf640C Series

Color Imageclass Mf740C Series

Canon Color Imageclass X Lbp1127C

Canon Satera Lbp620C Series

Canon Satera Lbp660C Series

Canon Satera Mf640C Series

Canon Satera Mf740C Series

Canon I-Sensys C1127I

Canon I-Sensys Lbp620C Series

Canon I-Sensys Lbp660C Series

Canon I-Sensys Mf640C Series

Canon I-Sensys Mf740C Series

Referências · 7

• https://canon.jp/support/support-info/230414vulnerability-response · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-0858 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0858 · Aviso do Fabricante
• https://canon-europe.com/support/product-security-latest-news · Nota
• https://usa.canon.com/support/canon-product-advisories/Service-Notice-Vulnerabilities-Remediation-Against-Buffer-Overflow · Nota
• https://psirt.canon/advisory-information/cp2023-001 · Nota
• https://t.me/cibsecurity/63879 · Publicação no Telegram