PT-2024-14905 · Canon+1 · Canon Imageclass Mf753Cdw+10

Published 2024-02-05 · Updated 2024-02-13 · CVE-2023-6232

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Canon imageCLASS MF753Cdw firmware versions prior to v03.08 Satera LBP670C Series/Satera MF750C Series firmware versions prior to v03.08 Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware versions prior to v03.08 i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware versions prior to v03.08

Description A buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. This issue can be exploited by network-adjacent attackers without requiring authentication.

Recommendations For Canon imageCLASS MF753Cdw firmware version v03.07 and earlier, update to firmware version v03.08 or later. For Satera LBP670C Series/Satera MF750C Series firmware version v03.07 and earlier, update to firmware version v03.08 or later. For Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware version v03.07 and earlier, update to firmware version v03.08 or later. For i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware version v03.07 and earlier, update to firmware version v03.08 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2023-6232

ZDI-24-092

Affected Products

C1333P

C1333I Series

Canon Imageclass Mf753Cdw

Color Imageclass Lbp674C

Color Imageclass Mf750C Series

Color Imageclass X Lbp1333C

Color Imageclass X Mf1333C Series

Satera Lbp670C Series

Satera Mf750C Series

I-Sensys Lbp673Cdw

I-Sensys Mf750C Series

References · 11

• https://canon-europe.com/support/product-security-latest-news · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6232 · Security Note
• https://psirt.canon/advisory-information/cp2024-001 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-24-092 · Security Note
• https://osv.dev/vulnerability/CVE-2023-6232 · Vendor Advisory
• https://canon.jp/support/support-info/240205vulnerability-response · Vendor Advisory
• https://usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers · Vendor Advisory
• https://twitter.com/CVEnew/status/1754686013136666962 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1755246430699012219 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1755139904693039372 · Twitter Post
• https://t.me/cvenotify/70212 · Telegram Post