PT-2025-1924 · Canon · I-Sensys Mf651Cdw+12

Exluck · Published 2025-01-28 · Updated 2026-01-26 · CVE-2024-12647

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Satera MF656Cdw/Satera MF654Cdw versions v05.04 and earlier Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw versions v05.04 and earlier i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw versions v05.04 and earlier

Description A buffer overflow issue exists in the CPCA font download processing of certain Small Office Multifunction Printers and Laser Printers. This may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.

Recommendations Satera MF656Cdw/Satera MF654Cdw versions v05.04 and earlier: Update the firmware to a version later than v05.04. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw versions v05.04 and earlier: Update the firmware to a version later than v05.04. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw versions v05.04 and earlier: Update the firmware to a version later than v05.04.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2024-12647

ZDI-25-073

Affected Products

Color Imageclass Lbp632Cdw

Color Imageclass Lbp633Cdw

Color Imageclass Mf652Cdw

Color Imageclass Mf653Cdw

Color Imageclass Mf654Cdw

Color Imageclass Mf656Cdw

Satera Mf654Cdw

Satera Mf656Cdw

I-Sensys Lbp631Cdw

I-Sensys Lbp633Cdw

I-Sensys Mf651Cdw

I-Sensys Mf655Cdw

I-Sensys Mf657Cdw

References · 23

• https://psirt.canon/advisory-information/cp2025-001 · Vendor Advisory
• https://usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers · Vendor Advisory
• https://canon-europe.com/support/product-security/#news · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-25-073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-12647 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12647 · Vendor Advisory
• https://canon.jp/support/support-info/250127vulnerability-response · Vendor Advisory
• https://t.me/cveNotify/149866 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1884172411425194076 · Twitter Post
• https://twitter.com/TMJIntel/status/1885083567086002423 · Twitter Post
• https://twitter.com/fletch_ai/status/1885191436481815031 · Twitter Post
• https://t.me/pentestingnews/55859 · Telegram Post
• https://twitter.com/autumn_good_35/status/1884816650589110597 · Twitter Post
• https://twitter.com/Dinosn/status/1884810206464373024 · Twitter Post
• https://twitter.com/TheZDIBugs/status/1886527739412259032 · Twitter Post