PT-2022-9200 · Canon · Imagerunner+3

Murashima Masahiro · Published 2022-02-08 · Updated 2022-02-14 · CVE-2021-20877

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Canon laser printers and small office multifunctional printers versions (affected versions not specified)

Description A cross-site scripting issue allows remote attackers to inject an arbitrary script via unspecified vectors. This affects various Canon printer models sold in Japan, the US, and Europe, including imageCLASS MF Series, imageCLASS LBP Series, iSENSYS, and imageRUNNER.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-20877

Affected Products

Isensys

Imageclass Lbp Series

Imageclass Mf Series

Imagerunner

References · 8

• https://canon-europe.com/support/product-security-latest-news · Vendor Advisory
• https://cweb.canon.jp/e-support/info/211221xss.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20877 · Security Note
• https://usa.canon.com/internet/portal/us/home/support/product-advisories/detail/Service-Notice-Canon-Laser-Printer-and-Small-Office-Multifunctional-Printer-related-to-cross-site-scripting · Vendor Advisory
• https://t.me/cibsecurity/36993 · Telegram Post
• https://jvn.jp/jp/JVN64806328/index.html · Note
• https://t.me/cvenotify/26431 · Telegram Post
• https://jvn.jp/en/jp/JVN64806328/index.html · Note