NetSight
IP …
high8.8

CVE-2022-24674

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.

Impact

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.

Affected products

VendorProductAffected versions
CanonD1620 Firmware
All versions
CanonD1650 Firmware
All versions
CanonD1520 Firmware
All versions
CanonD1550 Firmware
All versions
CanonMf1127c Firmware
All versions
CanonMf1238 Firmware
All versions
CanonMf1238 Ii Firmware
All versions
CanonMf1643i Ii Firmware
All versions
CanonMf1643if Ii Firmware
All versions
CanonMf414dw Firmware
All versions
CanonMf416dw Firmware
All versions
CanonMf419dw Firmware
All versions

Weakness classification

CWE-121CWE-787

References