ByteOS Network

Type	CWE ID	Description
text	N/A	Buffer Overflow

Hyperlink	Resource
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/the-vulnerability-in-canon-digital-cameras	x_refsource_MISC
https://cweb.canon.jp/e-support/products/eos-d/190806dilc-firm.html	x_refsource_MISC
https://www.canon-europe.com/support/product-security/	x_refsource_CONFIRM
http://jvn.jp/en/vu/JVNVU97511331/index.html	x_refsource_MISC
https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera/	x_refsource_MISC

Hyperlink	Resource
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/the-vulnerability-in-canon-digital-cameras	x_refsource_MISC x_transferred
https://cweb.canon.jp/e-support/products/eos-d/190806dilc-firm.html	x_refsource_MISC x_transferred
https://www.canon-europe.com/support/product-security/	x_refsource_CONFIRM x_transferred
http://jvn.jp/en/vu/JVNVU97511331/index.html	x_refsource_MISC x_transferred
https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera/	x_refsource_MISC x_transferred

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Type	Version	Base score	Base severity	Vector
Primary	3.0	8.8	HIGH	CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	8.3	HIGH	AV:A/AC:L/Au:N/C:C/I:C/A:C

CWE ID	Type	Source
CWE-787	Primary	nvd@nist.gov

Hyperlink	Source	Resource
http://jvn.jp/en/vu/JVNVU97511331/index.html	vultures@jpcert.or.jp	Third Party Advisory
https://cweb.canon.jp/e-support/products/eos-d/190806dilc-firm.html	vultures@jpcert.or.jp	Vendor Advisory
https://research.checkpoint.com/say-cheese-ransomware-ing-a-dslr-camera/	vultures@jpcert.or.jp	Exploit Third Party Advisory
https://www.canon-europe.com/support/product-security/	vultures@jpcert.or.jp	Vendor Advisory
https://www.usa.canon.com/internet/portal/us/home/support/product-advisories/detail/the-vulnerability-in-canon-digital-cameras	vultures@jpcert.or.jp	Vendor Advisory

CVE-2022-24673

Matching Score-10

Assigner-Zero Day Initiative

View Details

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-6.68% / 90.85%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:39

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24672

Matching Score-10

Assigner-Zero Day Initiative

View Details

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.10% / 29.04%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:41

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2022-24674

Matching Score-10

Assigner-Zero Day Initiative

View Details

Matching Score-10

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.06% / 20.09%

||

7 Day CHG~0.00%

Published-28 Mar, 2023 | 00:00

Updated-19 Feb, 2025 | 15:37

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.

Vendor-Canon Inc.

Product-mf741cdw_firmware mf735cdw_firmware d1550_firmware mf6180dw mf641cw mf424dw_firmware mf1643i_ii_firmware mf1238_firmware lbp228dw_firmware mf543dw_firmware mf634cdw_firmware mf1238 mf451dw_firmware mf624cdw_firmware mf733cdw mf743cdw mf735cdw lbp612cdw mf746cdw 1435if\+mf448dw mf448dw_firmware mf6160dw_firmware mf644cdw_firmware lbp1127c_firmware d1650_firmware wg7250z_firmware mf632cdw 1435if\+_firmware lbp228dw lbp253dw_firmware mf445dw lbp227dw mf6160dw mf642cdw_firmware lbp1238 lbp654cdw mf416dw_firmware mf453dw_firmware mf1238_ii_firmware lbp214dw lbp227dw_firmware ir1435i mf644cdw d1520 1435if wg7240 1435p\+mf8280cw_firmware wg7250f lbp623cdw_firmware 1435i\+_firmware 1435p d1520_firmware mf1643if_ii mf641cw_firmware lbp622cdw d1550 mf525dw mf515dw mf729cdw mf733cdw_firmware mf6180dw_firmware d1620_firmware mf820cdn_firmware mf453dw mf634cdw mf452dw_firmware mf449dw wg7250_firmware lbp215dw_firmware 1435p\+_firmware mf731cdw_firmware mf8280cw lbp214dw_firmware lbp612cdw_firmware mf741cdw lbp623cdw lbp226dw mf426dw mf745cdw mf515dw_firmware mf624cdw ir1643if_firmware 1435i\+mf1238_ii mf628cdw_firmware mf1127c_firmware mf429dw_firmware lbp1127c ir1643i_firmware d1620 mf726cdw_firmware lbp654cdw_firmware mf419dw_firmware mf424dw lbp622cdw_firmware mf414dw_firmware mf414dw mf8580cdw lbp251dw_firmware mf426dw_firmware mf820cdn mf632cdw_firmware mf1127c lbp215dw mf745cdw_firmware mf731cdw mf525dw_firmware mf416dw mf455dw mf451dw ir1643i mf746cdw_firmware mf419dw mf449dw_firmware lbp1238_ii_firmware lbp236dw mf726cdw lbp251dw mf1643if_ii_firmware lbp237dw mf1643i_ii mf628cdw mf445dw_firmware lbp664cdw_firmware d1650 mf8580cdw_firmware wg7250 mf810cdn_firmware lbp236dw_firmware wg7250f_firmware mf729cdw_firmware lbp1238_firmware 1435p_firmware mf810cdn mf543dw wg7240_firmware mf642cdw mf429dw mf452dw mf455dw_firmware 1435if_firmware lbp237dw_firmware wg7250z mf743cdw_firmware lbp253dw lbp226dw_firmware lbp664cdw lbp1238_ii ir1643if ir1435i_firmware imageCLASS MF644Cdw

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-5999

Matching Score-10

Assigner-JPCERT/CC

View Details

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.32% / 54.74%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via blerequest command.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-6000

Matching Score-10

Assigner-JPCERT/CC

View Details

Matching Score-10

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.32% / 54.74%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via sendhostinfo command.

Vendor-Canon Inc.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-5994

Matching Score-8

Assigner-JPCERT/CC

View Details

Matching Score-8

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.10% / 28.43%

||

7 Day CHG~0.00%

Published-06 Aug, 2019 | 18:41

Updated-04 Aug, 2024 | 20:09

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via SendObjectInfo command.

Vendor-Canon Inc.

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CVE-2022-43608

Matching Score-8

Assigner-Zero Day Initiative

View Details

Matching Score-8

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.10% / 28.62%

||

7 Day CHG~0.00%

Published-29 Mar, 2023 | 00:00

Updated-14 Feb, 2025 | 20:24

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.

Vendor-Canon Inc.

Product-mf644cdw_firmware mf644cdw imageCLASS MF644Cdw

CWE ID-CWE-190

Integer Overflow or Wraparound

CVE-2024-2184

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.17% / 39.01%

||

7 Day CHG~0.00%

Published-11 Mar, 2024 | 00:26

Updated-28 Aug, 2024 | 20:24

Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.

Vendor-Canon Inc.

Product-Satera LBP660C Series i-SENSYS MF740C Series C1127i Series Satera LBP620C Series i-SENSYS MF750C Series Color imageCLASS MF640C Series i-SENSYS MF640C Series Satera MF740C Series i-SENSYS LBP673Cdw C1333i Series Color imageCLASS MF740C Series i-SENSYS LBP620C Series Color imageCLASS LBP664Cdw Color imageCLASS MF750C Series Satera MF640C Series Color imageCLASS X LBP1127C Color imageCLASS X MF1333C C1127P C1333P Color imageCLASS X MF1127C Satera LBP670C Series Color imageCLASS X LBP1333C Color imageCLASS LBP622Cdw i-SENSYS LBP660C Series Color imageCLASS LBP674Cdw Satera MF750C Series c1127i_series i-sensys_mf750c_series c1333i_series i-sensys_mf640c_series satera_lbp670c_series color_imageclass_lbp622cdw satera_mf740c_series color_imageclass_x_lbp1127c color_imageclass_mf750c_series color_imageclass_mf640c_series c1127p color_imageclass_x_mf1333c satera_mf640c_series i-sensys_lbp660c_series color_imageclass_x_lbp1333c i-sensys_lbp673cdw satera_mf750c_series color_imageclass_lbp664cdw satera_lbp660c_series satera_lbp620c_series i-sensys_lbp620c_series color_imageclass_mf740c_series color_imageclass_x_mf1127c color_imageclass_lbp674cdw c1333p i-sensys_mf740c_series

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-0244

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.58% / 67.98%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:24

Updated-17 Jun, 2025 | 21:29

Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6234

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.45% / 62.54%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:23

Updated-02 Aug, 2024 | 08:21

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Color imageCLASS LBP674C Color imageCLASS MF750C Series Color imageCLASS X MF1333C Series i-SENSYS MF750C Series i-SENSYS LBP673Cdw C1333P Satera LBP670C Series Color imageCLASS X LBP1333C C1333i Series Satera MF750C Series mf750c i-sensys_lbp673cdw i-sensys_x_c1333p lbp1333c lbp674c mf1333c

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6232

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.43% / 61.79%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:22

Updated-17 Jun, 2025 | 21:29

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6229

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.45% / 62.54%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:20

Updated-17 Jun, 2025 | 21:29

Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6233

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.37% / 58.24%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:23

Updated-17 Jun, 2025 | 21:29

Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6230

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.43% / 61.79%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:21

Updated-17 Jun, 2025 | 21:29

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0853

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.18%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:57

Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0852

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.18%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 21:00

Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0856

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.17% / 38.50%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 21:00

Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0854

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.17% / 38.50%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:59

Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-6231

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.37% / 58.24%

||

7 Day CHG~0.00%

Published-06 Feb, 2024 | 00:22

Updated-17 Jun, 2025 | 21:29

Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_mf754cdw_firmware mf751cdw mf273dw_firmware lbp671c mf1238_ii lbp672c_firmware mf1643i_ii_firmware i-sensys_x_c1333i_firmware mf1333c lbp236dw_firmware mf275dw i-sensys_x_c1333p_firmware lbp122dw i-sensys_x_c1333i mf1643if_ii mf272dw lbp671c_firmware mf451dw_firmware lbp674cdw lbp672c i-sensys_mf754cdw mf1333c_firmware mf753cdw i-sensys_x_c1333if_firmware i-sensys_mf752cdw i-sensys_x_c1333p mf453dw mf452dw mf455dw_firmware lbp1333c_firmware lbp122dw_firmware lbp674c_firmware mf455dw mf755cdw_firmware mf452dw_firmware mf451dw lbp237dw_firmware mf753cdw_firmware lbp674cdw_firmware i-sensys_x_c1333if i-sensys_lbp673cdw_firmware i-sensys_lbp673cdw mf273dw lbp1238_ii mf275dw_firmware lbp1238_ii_firmware lbp1333c mf755cdw mf453dw_firmware mf1238_ii_firmware lbp236dw i-sensys_mf752cdw_firmware mf751cdw_firmware mf272dw_firmware lbp674c mf1643if_ii_firmware lbp237dw mf1643i_ii Satera LBP670C Series Color imageCLASS MF750C Series C1333i Series Color imageCLASS LBP674C Color imageCLASS X MF1333C Series Satera MF750C Series i-SENSYS LBP673Cdw i-SENSYS MF750C Series Color imageCLASS X LBP1333C C1333P

CWE ID-CWE-787

Out-of-bounds Write

CVE-2025-2146

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.18% / 39.86%

||

7 Day CHG~0.00%

Published-25 May, 2025 | 23:36

Updated-03 Jun, 2025 | 15:49

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

Vendor-Canon Inc.

Product-imageclass_mf653cdw_firmware imagerunner_1643if_ii imageclass_mf656cdw_firmware i-sensys_lbp233dw_firmware i-sensys_mf453dw satera_mf457dw i-sensys_mf655cdw_firmware i-sensys_lbp233dw i-sensys_mf657cdw_firmware i-sensys_x_1238pr_ii_firmware imageclass_mf455dw_firmware i-sensys_lbp631cdw_firmware imageclass_mf451dw_firmware i-sensys_mf651cdw_firmware i-sensys_mf552dw_firmware imageclass_mf452dw_firmware i-sensys_mf455dw_firmware imageclass_x_mf1643i_ii imageclass_mf455dw satera_mf551dw i-sensys_x_1238p_ii imageclass_mf653cdw i-sensys_lbp236dw_firmware i-sensys_mf455dw imageclass_x_lbp1238_ii imageclass_lbp632cdw_firmware satera_mf656cdw_firmware imageclass_mf652cdw_firmware imageclass_mf451dw imageclass_lbp236dw imageclass_mf452dw i-sensys_x_1238pr_ii imageclass_x_mf1643if_ii i-sensys_lbp633cdw_firmware imageclass_lbp237dw_firmware imagerunner_1643if_ii_firmware i-sensys_mf657cdw i-sensys_lbp236dw i-sensys_x_1238p_ii_firmware imageclass_mf453dw_firmware i-sensys_mf651cdw i-sensys_mf453dw_firmware i-sensys_x_1238if_ii i-sensys_lbp631cdw satera_mf551dw_firmware imageclass_x_mf1238_ii satera_mf654cdw imagerunner_1643i_ii imageclass_mf652cdw i-sensys_mf553dw_firmware imageclass_mf656cdw i-sensys_lbp633cdw imagerunner_1643i_ii_firmware i-sensys_x_1238i_ii_firmware imageclass_x_mf1238_ii_firmware imageclass_lbp237dw imageclass_x_mf1643i_ii_firmware imageclass_mf654cdw_firmware imageclass_mf654cdw i-sensys_mf553dw i-sensys_x_1238if_ii_firmware satera_mf654cdw_firmware i-sensys_x_1238i_ii imageclass_mf453dw imageclass_lbp633cdw imageclass_x_lbp1238_ii_firmware imageclass_lbp633cdw_firmware satera_mf656cdw imageclass_x_mf1643if_ii_firmware satera_mf457dw_firmware imageclass_lbp236dw_firmware imageclass_lbp632cdw i-sensys_mf655cdw i-sensys_mf552dw imageCLASS MF453dw Satera MF457dw imageCLASS MF455dw i-SENSYS MF655Cdw i-SENSYS MF455dw i-SENSYS X 1238P II imageCLASS X MF1643i II imageCLASS X MF1643iF II i-SENSYS MF453dw Color imageCLASS MF656Cdw imageCLASS X MF1238 II i-SENSYS X 1238iF II imageCLASS MF451dw Color imageCLASS MF654Cdw i-SENSYS MF651Cdw i-SENSYS MF553dw i-SENSYS MF552dw imageCLASS LBP237dw Color imageCLASS MF653Cdw imageRUNNER 1643iF II i-SENSYS LBP233dw Color imageCLASS LBP633Cdw i-SENSYS X 1238Pr II Color imageCLASS MF652Cdw i-SENSYS X 1238i II Color imageCLASS LBP632Cdw i-SENSYS LBP633Cdw imageCLASS MF452dw i-SENSYS LBP236dw Satera MF551dw i-SENSYS MF657Cdw Satera MF656Cdw imageCLASS LBP236dw Satera MF654Cdw imageCLASS X LBP1238 II i-SENSYS LBP631Cdw imageRUNNER 1643i II

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0855

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.17% / 38.50%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:58

Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-0851

Matching Score-6

Assigner-Canon Inc.

View Details

Matching Score-6

Assigner-Canon Inc.

CVSS Score-9.8||CRITICAL

EPSS-0.24% / 47.18%

||

7 Day CHG~0.00%

Published-11 May, 2023 | 00:00

Updated-10 Feb, 2025 | 20:58

Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Vendor-Canon Inc.

Product-i-sensys_x_c1127i i-sensys_mf645cx_firmware mf741cdw_firmware i-sensys_x_c1127p mf745cdw imageprograf_tc-20m i-sensys_mf746cx_firmware mf273dw_firmware i-sensys_mf641cw_firmware mf641cw imageprograf_tc-20m_firmware mf1127c_firmware i-sensys_mf641cw i-sensys_lbp623cdw lbp1127c mf275dw lbp621c_firmware maxify_gx4020 lbp122dw mf262dw_ii lbp622cdw_firmware i-sensys_lbp623cdw_firmware mf743cdw lbp661c_firmware maxify_gx3020 mf746cdw mf644cdw_firmware mf267dw_ii_firmware lbp1127c_firmware mf1127c lbp622c_firmware mf269dw_ii mf745cdw_firmware i-sensys_mf746cx imageprograf_tc-20_firmware i-sensys_mf744cdw mf269dw_vp_ii_firmware lbp662c_firmware mf642cdw_firmware mf746cdw_firmware i-sensys_x_c1127p_firmware mf273dw i-sensys_x_c1127i_firmware imageprograf_tc-20 i-sensys_lbp621cw i-sensys_x_c1127if i-sensys_x_c1127if_firmware mf272dw_firmware mf644cdw i-sensys_lbp664cx lbp664cdw_firmware pixma_g4270 pixma_g3270 i-sensys_mf645cx i-sensys_lbp633cdw_firmware i-sensys_mf744cdw_firmware lbp623cdw_firmware pixma_g4270_firmware lbp622c pixma_g3270_firmware i-sensys_mf643cdw_firmware maxify_gx4020_firmware i-sensys_lbp621cw_firmware mf272dw mf641cw_firmware lbp622cdw lbp664c_firmware i-sensys_lbp633cdw mf264dw_ii mf642cdw mf264dw_ii_firmware lbp662c lbp621c i-sensys_mf742cdw_firmware mf262dw_ii_firmware lbp122dw_firmware lbp661c i-sensys_mf742cdw mf743cdw_firmware lbp664cdw mf269dw_ii_firmware i-sensys_mf643cdw mf269dw_vp_ii i-sensys_lbp664cx_firmware mf275dw_firmware lbp664c mf267dw_ii maxify_gx3020_firmware mf741cdw lbp623cdw Canon Office/Small Office Multifunction Printers and Laser Printers

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-5948

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-4.30% / 88.41%

||

7 Day CHG~0.00%

Published-13 Jun, 2024 | 19:40

Updated-07 Aug, 2024 | 17:59

Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability

Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Deep Sea Electronics DSE855 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of multipart boundaries. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23170.

Vendor-deepseaelectronics Deep Sea Electronics deep_sea_electronics

Product-dse855 dse855_firmware DSE855 dse855

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18716

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.27% / 50.33%

||

7 Day CHG~0.00%

Published-24 Apr, 2020 | 13:30

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-d6200_firmware r6800 r6900_firmware r6900 r6700 d6200 r6700_firmware r6800_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18730

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.46% / 63.06%

||

7 Day CHG~0.00%

Published-24 Apr, 2020 | 12:53

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6020 before 1.0.0.30, R6080 before 1.0.0.30, R6120 before 1.0.0.36, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-d6200_firmware r6800 r6900_firmware r6900 r6080 r6020 r6120 d6200 r6700 r6080_firmware r6700_firmware r6020_firmware r6800_firmware r6120_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18738

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.78% / 72.83%

||

7 Day CHG~0.00%

Published-23 Apr, 2020 | 16:04

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects EX6150v2 before 1.0.1.54, R6400 before 1.0.1.24, R6400v2 before 1.0.2.32, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.10, R7000P before 1.2.0.22, R6900P before 1.2.0.22, R7100LG before 1.0.0.32, R7300DST before 1.0.0.54, R7900 before 1.0.1.18, R8000 before 1.0.3.48, R8300 before 1.0.2.106, R8500 before 1.0.2.106, R6100 before 1.0.1.16, WNDR4300v2 before 1.0.0.48, WNDR4500v3 before 1.0.0.48, and WNR2000v5 before 1.0.0.58.

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18724

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.27% / 50.33%

||

7 Day CHG~0.00%

Published-24 Apr, 2020 | 13:12

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-d6200_firmware r6800 r6900_firmware r6900 r6700 d6200 r6700_firmware r6800_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18722

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-0.27% / 50.33%

||

7 Day CHG~0.00%

Published-24 Apr, 2020 | 13:14

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an unauthenticated attacker. This affects D6200 before 1.1.00.24, R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-d6200_firmware r6800 r6900_firmware r6900 r6700 d6200 r6700_firmware r6800_firmware n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-18758

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-8.8||HIGH

EPSS-1.15% / 77.65%

||

7 Day CHG~0.00%

Published-22 Apr, 2020 | 16:04

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by a stack-based buffer overflow by an authenticated user. This affects R6700v2 before 1.1.0.42, R6800 before 1.1.0.42, and R6900v2 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-r6800 r6900_firmware r6700 r6800_firmware r6700_firmware r6900 n/a

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-13256

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

View Details

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.30% / 52.90%

||

7 Day CHG~0.00%

Published-04 Apr, 2018 | 17:00

Updated-16 Sep, 2024 | 16:34

In process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68817966.

Vendor-Google LLC

Product-android Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-43689

Matching Score-4

Assigner-JPCERT/CC

View Details

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-8.8||HIGH

EPSS-0.70% / 71.11%

||

7 Day CHG~0.00%

Published-21 Oct, 2024 | 01:27

Updated-26 Nov, 2024 | 08:15

Stack-based buffer overflow vulnerability exists in ELECOM wireless access points. By processing a specially crafted HTTP request, arbitrary code may be executed.

Vendor-Elecom Co., Ltd.

Product-wab-i1750-ps_firmware wab-s1167-ps wab-s1167-ps_firmware wab-i1750-ps WAB-M1775-PS WAB-S1775 WAB-I1750-PS WAB-S733MI WAB-S1167-PS wab-i1750-ps_firmware wab-s1167-ps_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-3846

Matching Score-4

Assigner-Red Hat, Inc.

View Details

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-8||HIGH

EPSS-0.32% / 54.76%

||

7 Day CHG~0.00%

Published-03 Jun, 2019 | 18:25

Updated-04 Aug, 2024 | 19:19

A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wireless network.

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-34991

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.56% / 67.45%

||

7 Day CHG~0.00%

Published-15 Nov, 2021 | 15:40

Updated-04 Aug, 2024 | 00:26

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service, which listens on TCP port 5000 by default. When parsing the uuid request header, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14110.

Vendor-NETGEAR, Inc.

Product-rax48_firmware rax15 r6400_firmware r7100lg ex3700 rax50 r6900p_firmware d6220 r8300 r7100lg_firmware rax45 r8500_firmware r7960p rs400 d7000v2 r7000_firmware rax40v2_firmware r6700v3 rax20 r6700v3_firmware rax50s_firmware d6220_firmware ex6130 r7900p rax20_firmware raxe500 rax50s wndr3400v3 raxe450 rax35v2 rax38v2_firmware rax40v2 rax43_firmware rax42 r6400v2 r7000 rax43 rax80_firmware d6400 dgn2200v4 ex3800 ex3700_firmware raxe450_firmware ex6120 rax48 r7900p_firmware r8000_firmware rax80 rs400_firmware r8000 rax75 r6900p ex3800_firmware r8000p dgn2200v4_firmware r8000p_firmware wndr3400v3_firmware d6400_firmware r7850 rax200 r7000p_firmware rax200_firmware r8500 dc112a ex6130_firmware rax38v2 r7850_firmware cax80_firmware r8300_firmware rax42_firmware d7000v2_firmware wnr3500lv2 xr300 r7000p cax80 r6400v2_firmware xr300_firmware rax35v2_firmware raxe500_firmware r7960p_firmware wnr3500lv2_firmware rax15_firmware dc112a_firmware rax75_firmware rax50_firmware r6400 rax45_firmware ex6120_firmware R6400v2

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-34978

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.19% / 40.72%

||

7 Day CHG~0.00%

Published-13 Jan, 2022 | 21:44

Updated-04 Aug, 2024 | 00:26

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13511.

Vendor-NETGEAR, Inc.

Product-r6260 r6260_firmware R6260

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-31439

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-1.03% / 76.46%

||

7 Day CHG~0.00%

Published-21 May, 2021 | 00:00

Updated-14 Jan, 2025 | 19:29

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Synology DiskStation Manager. Authentication is not required to exploit this vulnerablity. The specific flaw exists within the processing of DSI structures in Netatalk. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-12326.

Vendor-netatalk Debian GNU/Linux Synology, Inc.

Product-diskstation_manager netatalk debian_linux DiskStation Manager

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-32136

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.65% / 69.98%

||

7 Day CHG~0.00%

Published-03 May, 2024 | 01:56

Updated-16 May, 2025 | 19:08

D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1360 webproc var:menu Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1360 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling requests to the /cgi-bin/webproc endpoint. When parsing the var:menu parameter, the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. . Was ZDI-CAN-18414.

Vendor-D-Link Corporation

Product-dap-1360 dap-2020_firmware dap-1360_firmware dap-2020 DAP-1360 dap-1360_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-27253

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.55% / 66.78%

||

7 Day CHG~0.00%

Published-14 Apr, 2021 | 15:45

Updated-03 Aug, 2024 | 20:48

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR Nighthawk R7800. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the handling of the rc_service parameter provided to apply_bind.cgi. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12303.

Vendor-NETGEAR, Inc.

Product-br500_firmware rbk12 rbk43s br500 r8900_firmware rbr40_firmware rbk23_firmware rbk14_firmware rbk15_firmware ex6410 ex6420_firmware ex7300v2_firmware br200_firmware ex6250_firmware rbk53_firmware xr500_firmware xr700_firmware rbk15 xr450_firmware ex7300 rbk12_firmware rbs40 rbs50y_firmware r8900 rbs40_firmware r9000_firmware rbr10 rbs10_firmware rbk43_firmware ex6410_firmware rbs20 rbs50_firmware ex6150 r9000 rbs50y ex7700_firmware r7800 rbk23 rbs10 r7800_firmware ex6100v2_firmware rbk20_firmware xr450 ex6150_firmware xr700 ex6400 rbk43s_firmware rbk20 ex6400_firmware rbk14 ex7300_firmware rbk44_firmware rbs20_firmware br200 d7800 rbk44 ex8000 rbk40 ex7320_firmware rbr20 rbk40_firmware rbk13 xr500 ex6400v2_firmware ex6100 ex6420 d7800_firmware rbk43 ex8000_firmware ex6250 rbr10_firmware rbr40 rbs50 rbr50_firmware rbr50 ex7700 rbk13_firmware lbr20 rbr20_firmware ex7320 rbk50 rbk53 lbr20_firmware rbk50_firmware R7800

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44406

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-2.35% / 84.27%

||

7 Day CHG-0.05%

Published-03 May, 2024 | 02:13

Updated-12 Mar, 2025 | 17:41

D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings DeviceName Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18825.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2017-13255

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

View Details

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.30% / 52.90%

||

7 Day CHG~0.00%

Published-04 Apr, 2018 | 17:00

Updated-17 Sep, 2024 | 02:37

In process_service_attr_req of sdp_server.c, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68776054.

Vendor-Google LLC

Product-android Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44419

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-0.52% / 65.60%

||

7 Day CHG~0.00%

Published-03 May, 2024 | 02:13

Updated-13 May, 2025 | 14:05

D-Link DIR-X3260 Prog.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DIR-X3260 Prog.cgi Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver. The issue results from the lack of proper validation of the length an user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20774.

Vendor-D-Link Corporation

Product-dir-x3260_firmware dir-x3260 DIR-X3260 dir-x3260

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-41202

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-2.61% / 85.06%

||

7 Day CHG+0.18%

Published-03 May, 2024 | 02:11

Updated-12 Mar, 2025 | 17:35

D-Link DAP-1325 SetAPLanSettings Mode Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings Mode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18828.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-0930

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

View Details

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-0.67% / 70.34%

||

7 Day CHG~0.00%

Published-15 Dec, 2021 | 18:05

Updated-03 Aug, 2024 | 15:55

In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-181660091

Vendor-n/a Google LLC

Product-android Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-0507

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

View Details

Matching Score-4

Assigner-Android (associated with Google Inc. or Open Handset Alliance)

CVSS Score-8.8||HIGH

EPSS-1.09% / 77.04%

||

7 Day CHG~0.00%

Published-21 Jun, 2021 | 16:01

Updated-03 Aug, 2024 | 15:40

In handle_rc_metamsg_cmd of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181860042

Vendor-n/a Google LLC

Product-android Android

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44405

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-1.54% / 80.60%

||

7 Day CHG-0.03%

Published-03 May, 2024 | 02:13

Updated-12 Mar, 2025 | 17:40

D-Link DAP-1325 get_value_of_key Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 get_value_of_key Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18824.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44409

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-1.54% / 80.60%

||

7 Day CHG-0.03%

Published-03 May, 2024 | 02:13

Updated-12 Mar, 2025 | 17:41

D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetSetupWizardStatus Enabled Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18838.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44407

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-1.54% / 80.60%

||

7 Day CHG-0.03%

Published-03 May, 2024 | 02:13

Updated-12 Mar, 2025 | 17:41

D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings Gateway Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18826.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44445

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-2.40% / 84.44%

||

7 Day CHG~0.00%

Published-03 May, 2024 | 02:14

Updated-07 Aug, 2025 | 15:58

NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability

NETGEAR CAX30 SSO Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR CAX30 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the sso binary. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-19058.

Vendor-NETGEAR, Inc.

Product-cax30_firmware cax30 CAX30 CAX30

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-44404

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-1.54% / 80.60%

||

7 Day CHG-0.03%

Published-03 May, 2024 | 02:13

Updated-12 Mar, 2025 | 17:40

D-Link DAP-1325 get_value_from_app Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 get_value_from_app Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18823.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2024-10194

Matching Score-4

Assigner-VulDB

View Details

Matching Score-4

Assigner-VulDB

CVSS Score-8.7||HIGH

EPSS-0.10% / 28.98%

||

7 Day CHG~0.00%

Published-20 Oct, 2024 | 08:00

Updated-23 Oct, 2024 | 16:16

WAVLINK WN530H4/WN530HG4/WN572HG3 Front-End Authentication Page login.cgi Goto_chidx stack-based overflow

A vulnerability was found in WAVLINK WN530H4, WN530HG4 and WN572HG3 up to 20221028. It has been classified as critical. Affected is the function Goto_chidx of the file login.cgi of the component Front-End Authentication Page. The manipulation of the argument wlanUrl leads to stack-based buffer overflow. The attack can only be initiated within the local network. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vendor-WAVLINK Technology Ltd.

Product-wn530h4 wn530h4_firmware wn530hg4_firmware wn530hg4 wn572hg3_firmware wn572hg3 WN530H4 WN572HG3 WN530HG4 wn530hg4 wn530h4 wn572hg3

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2023-41214

Matching Score-4

Assigner-Zero Day Initiative

View Details

Matching Score-4

Assigner-Zero Day Initiative

CVSS Score-8.8||HIGH

EPSS-2.61% / 85.06%

||

7 Day CHG+0.18%

Published-03 May, 2024 | 02:12

Updated-12 Mar, 2025 | 17:40

D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18841.

Vendor-D-Link Corporation

Product-dap-1325_firmware dap-1325 DAP-1325 dap-1325_firmware

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-5998

Credits

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs