Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2022-24672

Summary
Assigner-zdi
Assigner Org ID-99f1926a-a320-47d8-bbb5-42feb611262e
Published At-28 Mar, 2023 | 00:00
Updated At-19 Feb, 2025 | 15:41
Rejected At-
Credits

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:zdi
Assigner Org ID:99f1926a-a320-47d8-bbb5-42feb611262e
Published At:28 Mar, 2023 | 00:00
Updated At:19 Feb, 2025 | 15:41
Rejected At:
â–¼CVE Numbering Authority (CNA)

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

Affected Products
Vendor
Canon Inc.Canon
Product
imageCLASS MF644Cdw
Versions
Affected
  • 10.02
Problem Types
TypeCWE IDDescription
CWECWE-122CWE-122: Heap-based Buffer Overflow
Type: CWE
CWE ID: CWE-122
Description: CWE-122: Heap-based Buffer Overflow
Metrics
VersionBase scoreBase severityVector
3.08.8HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Version: 3.0
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Mehdi Talbi (@abu_y0ussef), Remi Jullian (@netsecurity1), Thomas Jeunet (@cleptho), from @Synacktiv
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.zerodayinitiative.com/advisories/ZDI-22-514/
N/A
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
N/A
Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-514/
Resource: N/A
Hyperlink: https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
Resource: N/A
â–¼Authorized Data Publishers (ADP)
1. CVE Program Container
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.zerodayinitiative.com/advisories/ZDI-22-514/
x_transferred
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
x_transferred
Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-514/
Resource:
x_transferred
Hyperlink: https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
Resource:
x_transferred
2. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:zdi-disclosures@trendmicro.com
Published At:28 Mar, 2023 | 19:15
Updated At:03 Apr, 2023 | 18:52

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.18.8HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary3.08.8HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Primary
Version: 3.1
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.0
Base score: 8.8
Base severity: HIGH
Vector:
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE Matches
Canon Inc.
canon
>>d1620_firmware>>-
cpe:2.3:o:canon:d1620_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1620>>-
cpe:2.3:h:canon:d1620:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1650_firmware>>-
cpe:2.3:o:canon:d1650_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1650>>-
cpe:2.3:h:canon:d1650:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1520_firmware>>-
cpe:2.3:o:canon:d1520_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1520>>-
cpe:2.3:h:canon:d1520:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1550_firmware>>-
cpe:2.3:o:canon:d1550_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>d1550>>-
cpe:2.3:h:canon:d1550:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1127c_firmware>>-
cpe:2.3:o:canon:mf1127c_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1127c>>-
cpe:2.3:h:canon:mf1127c:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1238_firmware>>-
cpe:2.3:o:canon:mf1238_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1238>>-
cpe:2.3:h:canon:mf1238:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1238_ii_firmware>>-
cpe:2.3:o:canon:mf1238_ii_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1238_ii>>-
cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1643i_ii_firmware>>-
cpe:2.3:o:canon:mf1643i_ii_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1643i_ii>>-
cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1643if_ii_firmware>>-
cpe:2.3:o:canon:mf1643if_ii_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf1643if_ii>>-
cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf414dw_firmware>>-
cpe:2.3:o:canon:mf414dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf414dw>>-
cpe:2.3:h:canon:mf414dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf416dw_firmware>>-
cpe:2.3:o:canon:mf416dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf416dw>>-
cpe:2.3:h:canon:mf416dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf419dw_firmware>>-
cpe:2.3:o:canon:mf419dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf419dw>>-
cpe:2.3:h:canon:mf419dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf515dw_firmware>>-
cpe:2.3:o:canon:mf515dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf515dw>>-
cpe:2.3:h:canon:mf515dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf424dw_firmware>>-
cpe:2.3:o:canon:mf424dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf424dw>>-
cpe:2.3:h:canon:mf424dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf426dw_firmware>>-
cpe:2.3:o:canon:mf426dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf426dw>>-
cpe:2.3:h:canon:mf426dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf429dw_firmware>>-
cpe:2.3:o:canon:mf429dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf429dw>>-
cpe:2.3:h:canon:mf429dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf525dw_firmware>>-
cpe:2.3:o:canon:mf525dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf525dw>>-
cpe:2.3:h:canon:mf525dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf445dw_firmware>>-
cpe:2.3:o:canon:mf445dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf445dw>>-
cpe:2.3:h:canon:mf445dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf448dw_firmware>>-
cpe:2.3:o:canon:mf448dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf448dw>>-
cpe:2.3:h:canon:mf448dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf449dw_firmware>>-
cpe:2.3:o:canon:mf449dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf449dw>>-
cpe:2.3:h:canon:mf449dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf543dw_firmware>>-
cpe:2.3:o:canon:mf543dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf543dw>>-
cpe:2.3:h:canon:mf543dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf451dw_firmware>>-
cpe:2.3:o:canon:mf451dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf451dw>>-
cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf452dw_firmware>>-
cpe:2.3:o:canon:mf452dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf452dw>>-
cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf453dw_firmware>>-
cpe:2.3:o:canon:mf453dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf453dw>>-
cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf455dw_firmware>>-
cpe:2.3:o:canon:mf455dw_firmware:-:*:*:*:*:*:*:*
Canon Inc.
canon
>>mf455dw>>-
cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-787Primarynvd@nist.gov
CWE-122Secondaryzdi-disclosures@trendmicro.com
CWE ID: CWE-787
Type: Primary
Source: nvd@nist.gov
CWE ID: CWE-122
Type: Secondary
Source: zdi-disclosures@trendmicro.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctiozdi-disclosures@trendmicro.com
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-514/zdi-disclosures@trendmicro.com
Third Party Advisory
VDB Entry
Hyperlink: https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio
Source: zdi-disclosures@trendmicro.com
Resource:
Vendor Advisory
Hyperlink: https://www.zerodayinitiative.com/advisories/ZDI-22-514/
Source: zdi-disclosures@trendmicro.com
Resource:
Third Party Advisory
VDB Entry

Change History

0
Information is not available yet

Similar CVEs

341Records found
CVE-2019-6000
Matching Score-10
Assigner-JPCERT/CC
ShareView Details
Matching Score-10
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.33% / 55.04%
||
7 Day CHG~0.00%
Published-06 Aug, 2019 | 18:41
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via sendhostinfo command.

Action-Not Available
Vendor-Canon Inc.
Product-powershot_g5xmark_iieos_5d_mark_iveos_d_rebel_sl1eos_200deos_kiss_x90_firmwareeos_d_rebel_t6s_firmwareeos_rp_goldeos_7d_mark_iieos_750d_firmwareeos_250d_firmwareeos_m2eos_m5eos_d_rebel_sl2eos_kiss_x9ieos_d_rebel_t5_firmwareeos_r_firmwareeos_80deos-1d_x_mkiieos_m10_firmwareeos_250deos_1500d_firmwareeos_kiss_x9eos_m10eos_d_rebel_t6i_firmwareeos_2000deos_1300deos_d_rebel_t7i_firmwareeos_hi_firmwareeos_kiss_meos_1200d_mg_firmwareeos_d_rebel_t5_reeos_rpeos_kiss_x70_firmwareeos_kiss_x7_firmwareeos-1d_xeos_6deos_d_rebel_sl2_firmwareeos_m5_firmwareeos_m50eos_5ds_reos_kiss_x80eos_7d_mark_ii_firmwareeos_hieos_5ds_firmwareeos_760deos_d_rebel_sl3_firmwareeos_1200deos_d_rebel_t7eos_4000d_firmwareeos_8000d_firmwareeos_1300d_firmwareeos-1d_ceos_6d_firmwareeos_8000deos_d_rebel_t5ieos_kiss_x7ieos_kiss_x70eos_kiss_m_firmwareeos_6d_mark_iieos_kiss_x10eos_800deos_70deos_700deos_d_rebel_t100_firmwareeos_750deos_d_rebel_t6seos_m50_firmwareeos-1d_c_firmwareeos_d_rebel_t5eos_m100eos_d_rebel_t100eos_77dpowershot_sx740_hseos_1200d_firmwareeos_100d_firmwareeos_kiss_x80_firmwareeos_d_rebel_t5i_firmwareeos_kiss_x7eos_200d_firmwareeos_3000d_firmwareeos_kiss_x8ieos_5d_mark_iii_firmwarepowershot_g5xmark_ii_firmwareeos_m3_firmwareeos_m6\(china\)eos_kiss_x9_firmwareeos_m6_firmwareeos_kiss_x8i_firmwareeos_5ds_r_firmwareeos_3000deos_kiss_x7i_firmwareeos_kiss_x9i_firmwareeos_rp_gold_firmwarepowershot_sx740_hs_firmwareeos_d_rebel_t5_re_firmwareeos_760d_firmwareeos_5d_mark_iv_firmwareeos_m6\(china\)_firmwareeos_rp_firmwareeos_700d_firmwareeos_2000d_firmwareeos_d_rebel_sl3eos_m3eos_1500deos_d_rebel_t7_firmwareeos_6d_mark_ii_firmwareeos_100deos_d_rebel_sl1_firmwareeos_1200d_mgeos_kiss_x90eos_800d_firmwareeos_5dseos-1d_x_mkii_firmwareeos-1d_x_firmwareeos_d_rebel_t6_firmwareeos_9000d_firmwareeos_d_rebel_t6eos_reos_d_rebel_t7ipowershot_sx70_hseos_m6eos_m2_firmwareeos_kiss_x10_firmwarepowershot_sx70_hs_firmwareeos_9000deos_80d_firmwareeos_77d_firmwareeos_m100_firmwareeos_5d_mark_iiieos_4000deos_70d_firmwareeos_d_rebel_t6iEOS series digital cameras, PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5Xmarkâ…¡
CWE ID-CWE-787
Out-of-bounds Write
CVE-2019-5998
Matching Score-10
Assigner-JPCERT/CC
ShareView Details
Matching Score-10
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.33% / 55.04%
||
7 Day CHG~0.00%
Published-06 Aug, 2019 | 18:41
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via notifybtstatus command.

Action-Not Available
Vendor-Canon Inc.
Product-powershot_g5xmark_iieos_5d_mark_iveos_d_rebel_sl1eos_200deos_kiss_x90_firmwareeos_d_rebel_t6s_firmwareeos_rp_goldeos_7d_mark_iieos_750d_firmwareeos_250d_firmwareeos_m2eos_m5eos_d_rebel_sl2eos_kiss_x9ieos_d_rebel_t5_firmwareeos_r_firmwareeos_80deos-1d_x_mkiieos_m10_firmwareeos_250deos_1500d_firmwareeos_kiss_x9eos_m10eos_d_rebel_t6i_firmwareeos_2000deos_1300deos_d_rebel_t7i_firmwareeos_hi_firmwareeos_kiss_meos_1200d_mg_firmwareeos_d_rebel_t5_reeos_rpeos_kiss_x70_firmwareeos_kiss_x7_firmwareeos-1d_xeos_6deos_d_rebel_sl2_firmwareeos_m5_firmwareeos_m50eos_5ds_reos_kiss_x80eos_7d_mark_ii_firmwareeos_hieos_5ds_firmwareeos_760deos_d_rebel_sl3_firmwareeos_1200deos_d_rebel_t7eos_4000d_firmwareeos_8000d_firmwareeos_1300d_firmwareeos-1d_ceos_6d_firmwareeos_8000deos_d_rebel_t5ieos_kiss_x7ieos_kiss_x70eos_kiss_m_firmwareeos_6d_mark_iieos_kiss_x10eos_800deos_70deos_700deos_d_rebel_t100_firmwareeos_750deos_d_rebel_t6seos_m50_firmwareeos-1d_c_firmwareeos_d_rebel_t5eos_m100eos_d_rebel_t100eos_77dpowershot_sx740_hseos_1200d_firmwareeos_100d_firmwareeos_kiss_x80_firmwareeos_d_rebel_t5i_firmwareeos_kiss_x7eos_200d_firmwareeos_3000d_firmwareeos_kiss_x8ieos_5d_mark_iii_firmwarepowershot_g5xmark_ii_firmwareeos_m3_firmwareeos_m6\(china\)eos_kiss_x9_firmwareeos_m6_firmwareeos_kiss_x8i_firmwareeos_5ds_r_firmwareeos_3000deos_kiss_x7i_firmwareeos_kiss_x9i_firmwareeos_rp_gold_firmwarepowershot_sx740_hs_firmwareeos_d_rebel_t5_re_firmwareeos_760d_firmwareeos_5d_mark_iv_firmwareeos_m6\(china\)_firmwareeos_rp_firmwareeos_700d_firmwareeos_2000d_firmwareeos_d_rebel_sl3eos_m3eos_1500deos_d_rebel_t7_firmwareeos_6d_mark_ii_firmwareeos_100deos_d_rebel_sl1_firmwareeos_1200d_mgeos_kiss_x90eos_800d_firmwareeos_5dseos-1d_x_mkii_firmwareeos-1d_x_firmwareeos_d_rebel_t6_firmwareeos_9000d_firmwareeos_d_rebel_t6eos_reos_d_rebel_t7ipowershot_sx70_hseos_m6eos_m2_firmwareeos_kiss_x10_firmwarepowershot_sx70_hs_firmwareeos_9000deos_80d_firmwareeos_77d_firmwareeos_m100_firmwareeos_5d_mark_iiieos_4000deos_70d_firmwareeos_d_rebel_t6iEOS series digital cameras, PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5Xmarkâ…¡
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-24674
Matching Score-10
Assigner-Zero Day Initiative
ShareView Details
Matching Score-10
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-0.08% / 23.76%
||
7 Day CHG~0.00%
Published-28 Mar, 2023 | 00:00
Updated-19 Feb, 2025 | 15:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the privet API. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15834.

Action-Not Available
Vendor-Canon Inc.
Product-mf741cdw_firmwaremf735cdw_firmwared1550_firmwaremf6180dwmf641cwmf424dw_firmwaremf1643i_ii_firmwaremf1238_firmwarelbp228dw_firmwaremf543dw_firmwaremf634cdw_firmwaremf1238mf451dw_firmwaremf624cdw_firmwaremf733cdwmf743cdwmf735cdwlbp612cdwmf746cdw1435if\+mf448dwmf448dw_firmwaremf6160dw_firmwaremf644cdw_firmwarelbp1127c_firmwared1650_firmwarewg7250z_firmwaremf632cdw1435if\+_firmwarelbp228dwlbp253dw_firmwaremf445dwlbp227dwmf6160dwmf642cdw_firmwarelbp1238lbp654cdwmf416dw_firmwaremf453dw_firmwaremf1238_ii_firmwarelbp214dwlbp227dw_firmwareir1435imf644cdwd15201435ifwg72401435p\+mf8280cw_firmwarewg7250flbp623cdw_firmware1435i\+_firmware1435pd1520_firmwaremf1643if_iimf641cw_firmwarelbp622cdwd1550mf525dwmf515dwmf729cdwmf733cdw_firmwaremf6180dw_firmwared1620_firmwaremf820cdn_firmwaremf453dwmf634cdwmf452dw_firmwaremf449dwwg7250_firmwarelbp215dw_firmware1435p\+_firmwaremf731cdw_firmwaremf8280cwlbp214dw_firmwarelbp612cdw_firmwaremf741cdwlbp623cdwlbp226dwmf426dwmf745cdwmf515dw_firmwaremf624cdwir1643if_firmware1435i\+mf1238_iimf628cdw_firmwaremf1127c_firmwaremf429dw_firmwarelbp1127cir1643i_firmwared1620mf726cdw_firmwarelbp654cdw_firmwaremf419dw_firmwaremf424dwlbp622cdw_firmwaremf414dw_firmwaremf414dwmf8580cdwlbp251dw_firmwaremf426dw_firmwaremf820cdnmf632cdw_firmwaremf1127clbp215dwmf745cdw_firmwaremf731cdwmf525dw_firmwaremf416dwmf455dwmf451dwir1643imf746cdw_firmwaremf419dwmf449dw_firmwarelbp1238_ii_firmwarelbp236dwmf726cdwlbp251dwmf1643if_ii_firmwarelbp237dwmf1643i_iimf628cdwmf445dw_firmwarelbp664cdw_firmwared1650mf8580cdw_firmwarewg7250mf810cdn_firmwarelbp236dw_firmwarewg7250f_firmwaremf729cdw_firmwarelbp1238_firmware1435p_firmwaremf810cdnmf543dwwg7240_firmwaremf642cdwmf429dwmf452dwmf455dw_firmware1435if_firmwarelbp237dw_firmwarewg7250zmf743cdw_firmwarelbp253dwlbp226dw_firmwarelbp664cdwlbp1238_iiir1643ifir1435i_firmwareimageCLASS MF644Cdw
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-24673
Matching Score-10
Assigner-Zero Day Initiative
ShareView Details
Matching Score-10
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-9.17% / 92.50%
||
7 Day CHG~0.00%
Published-28 Mar, 2023 | 00:00
Updated-19 Feb, 2025 | 15:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.

Action-Not Available
Vendor-Canon Inc.
Product-mf741cdw_firmwaremf735cdw_firmwared1550_firmwaremf6180dwmf641cwmf424dw_firmwaremf1643i_ii_firmwaremf1238_firmwarelbp228dw_firmwaremf543dw_firmwaremf634cdw_firmwaremf1238mf451dw_firmwaremf624cdw_firmwaremf733cdwmf743cdwmf735cdwlbp612cdwmf746cdw1435if\+mf448dwmf448dw_firmwaremf6160dw_firmwaremf644cdw_firmwarelbp1127c_firmwared1650_firmwarewg7250z_firmwaremf632cdw1435if\+_firmwarelbp228dwlbp253dw_firmwaremf445dwlbp227dwmf6160dwmf642cdw_firmwarelbp1238lbp654cdwmf416dw_firmwaremf453dw_firmwaremf1238_ii_firmwarelbp214dwlbp227dw_firmwareir1435imf644cdwd15201435ifwg72401435p\+mf8280cw_firmwarewg7250flbp623cdw_firmware1435i\+_firmware1435pd1520_firmwaremf1643if_iimf641cw_firmwarelbp622cdwd1550mf525dwmf515dwmf729cdwmf733cdw_firmwaremf6180dw_firmwared1620_firmwaremf820cdn_firmwaremf453dwmf634cdwmf452dw_firmwaremf449dwwg7250_firmwarelbp215dw_firmware1435p\+_firmwaremf731cdw_firmwaremf8280cwlbp214dw_firmwarelbp612cdw_firmwaremf741cdwlbp623cdwlbp226dwmf426dwmf745cdwmf515dw_firmwaremf624cdwir1643if_firmware1435i\+mf1238_iimf628cdw_firmwaremf1127c_firmwaremf429dw_firmwarelbp1127cir1643i_firmwared1620mf726cdw_firmwarelbp654cdw_firmwaremf419dw_firmwaremf424dwlbp622cdw_firmwaremf414dw_firmwaremf414dwmf8580cdwlbp251dw_firmwaremf426dw_firmwaremf820cdnmf632cdw_firmwaremf1127clbp215dwmf745cdw_firmwaremf731cdwmf525dw_firmwaremf416dwmf455dwmf451dwir1643imf746cdw_firmwaremf419dwmf449dw_firmwarelbp1238_ii_firmwarelbp236dwmf726cdwlbp251dwmf1643if_ii_firmwarelbp237dwmf1643i_iimf628cdwmf445dw_firmwarelbp664cdw_firmwared1650mf8580cdw_firmwarewg7250mf810cdn_firmwarelbp236dw_firmwarewg7250f_firmwaremf729cdw_firmwarelbp1238_firmware1435p_firmwaremf810cdnmf543dwwg7240_firmwaremf642cdwmf429dwmf452dwmf455dw_firmware1435if_firmwarelbp237dw_firmwarewg7250zmf743cdw_firmwarelbp253dwlbp226dw_firmwarelbp664cdwlbp1238_iiir1643ifir1435i_firmwareimageCLASS MF644Cdw
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2019-5999
Matching Score-10
Assigner-JPCERT/CC
ShareView Details
Matching Score-10
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.33% / 55.04%
||
7 Day CHG~0.00%
Published-06 Aug, 2019 | 18:41
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via blerequest command.

Action-Not Available
Vendor-Canon Inc.
Product-powershot_g5xmark_iieos_5d_mark_iveos_d_rebel_sl1eos_200deos_kiss_x90_firmwareeos_d_rebel_t6s_firmwareeos_rp_goldeos_7d_mark_iieos_750d_firmwareeos_250d_firmwareeos_m2eos_m5eos_d_rebel_sl2eos_kiss_x9ieos_d_rebel_t5_firmwareeos_r_firmwareeos_80deos-1d_x_mkiieos_m10_firmwareeos_250deos_1500d_firmwareeos_kiss_x9eos_m10eos_d_rebel_t6i_firmwareeos_2000deos_1300deos_d_rebel_t7i_firmwareeos_hi_firmwareeos_kiss_meos_1200d_mg_firmwareeos_d_rebel_t5_reeos_rpeos_kiss_x70_firmwareeos_kiss_x7_firmwareeos-1d_xeos_6deos_d_rebel_sl2_firmwareeos_m5_firmwareeos_m50eos_5ds_reos_kiss_x80eos_7d_mark_ii_firmwareeos_hieos_5ds_firmwareeos_760deos_d_rebel_sl3_firmwareeos_1200deos_d_rebel_t7eos_4000d_firmwareeos_8000d_firmwareeos_1300d_firmwareeos-1d_ceos_6d_firmwareeos_8000deos_d_rebel_t5ieos_kiss_x7ieos_kiss_x70eos_kiss_m_firmwareeos_6d_mark_iieos_kiss_x10eos_800deos_70deos_700deos_d_rebel_t100_firmwareeos_750deos_d_rebel_t6seos_m50_firmwareeos-1d_c_firmwareeos_d_rebel_t5eos_m100eos_d_rebel_t100eos_77dpowershot_sx740_hseos_1200d_firmwareeos_100d_firmwareeos_kiss_x80_firmwareeos_d_rebel_t5i_firmwareeos_kiss_x7eos_200d_firmwareeos_3000d_firmwareeos_kiss_x8ieos_5d_mark_iii_firmwarepowershot_g5xmark_ii_firmwareeos_m3_firmwareeos_m6\(china\)eos_kiss_x9_firmwareeos_m6_firmwareeos_kiss_x8i_firmwareeos_5ds_r_firmwareeos_3000deos_kiss_x7i_firmwareeos_kiss_x9i_firmwareeos_rp_gold_firmwarepowershot_sx740_hs_firmwareeos_d_rebel_t5_re_firmwareeos_760d_firmwareeos_5d_mark_iv_firmwareeos_m6\(china\)_firmwareeos_rp_firmwareeos_700d_firmwareeos_2000d_firmwareeos_d_rebel_sl3eos_m3eos_1500deos_d_rebel_t7_firmwareeos_6d_mark_ii_firmwareeos_100deos_d_rebel_sl1_firmwareeos_1200d_mgeos_kiss_x90eos_800d_firmwareeos_5dseos-1d_x_mkii_firmwareeos-1d_x_firmwareeos_d_rebel_t6_firmwareeos_9000d_firmwareeos_d_rebel_t6eos_reos_d_rebel_t7ipowershot_sx70_hseos_m6eos_m2_firmwareeos_kiss_x10_firmwarepowershot_sx70_hs_firmwareeos_9000deos_80d_firmwareeos_77d_firmwareeos_m100_firmwareeos_5d_mark_iiieos_4000deos_70d_firmwareeos_d_rebel_t6iEOS series digital cameras, PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5Xmarkâ…¡
CWE ID-CWE-787
Out-of-bounds Write
CVE-2022-43608
Matching Score-8
Assigner-Zero Day Initiative
ShareView Details
Matching Score-8
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-0.13% / 32.40%
||
7 Day CHG~0.00%
Published-29 Mar, 2023 | 00:00
Updated-14 Feb, 2025 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.

Action-Not Available
Vendor-Canon Inc.
Product-mf644cdw_firmwaremf644cdwimageCLASS MF644Cdw
CWE ID-CWE-190
Integer Overflow or Wraparound
CVE-2019-5994
Matching Score-8
Assigner-JPCERT/CC
ShareView Details
Matching Score-8
Assigner-JPCERT/CC
CVSS Score-8.8||HIGH
EPSS-0.32% / 54.92%
||
7 Day CHG~0.00%
Published-06 Aug, 2019 | 18:41
Updated-04 Aug, 2024 | 20:09
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and earlier, EOS-1D C firmware version 1.4.1 and earlier, EOS 5D MARK III firmware version 1.3.5 and earlier, EOS 5D MARK IV firmware version 1.2.0 and earlier, EOS 5DS firmware version 1.1.2 and earlier, EOS 5DS R firmware version 1.1.2 and earlier, EOS 6D firmware version 1.1.8 and earlier, EOS 6D MARK II firmware version 1.0.4 and earlier, EOS 7D MARK II firmware version 1.1.2 and earlier, EOS 70 D firmware version 1.1.2 and earlier, EOS 80 D firmware version 1.0.2 and earlier, EOS KISS X7I / EOS D REBEL T5I / EOS 700D firmware version 1.1.5 and earlier, EOS KISS X8I / EOS D REBEL T6I / EOS 750D firmware version 1.0.0 and earlier, EOS KISS X9I / EOS D REBEL T7I / EOS 800D firmware version 1.0.1 and earlier, EOS KISS X7 / EOS D REBEL SL1 / EOS 100D firmware version 1.0.1 and earlier, EOS KISS X9 / EOS D REBEL SL2 / EOS 200D firmware version 1.0.1 and earlier, EOS KISS X10 / EOS D REBEL SL3 / EOS 200D / EOS 250D firmware version 1.0.1 and earlier, EOS 8000D / EOS D REBEL T6S / EOS 760D firmware version 1.0.0 and earlier, EOS 9000D / EOS 77D firmware version 1.0.2 and earlier, EOS KISS X70 / EOS D REBEL T5 / EOS 1200D firmware version 1.0.2 and earlier, EOS D REBEL T5 RE / EOS 1200D MG / EOS HI firmware version 1.0.2 and earlier, EOS KISS X80 / EOS D REBEL T6 / EOS 1300D firmware version 1.1.0 and earlier, EOS KISS X90 / EOS D REBEL T7 / EOS 1500D / EOS 2000D firmware version 1.0.0 and earlier, EOS D REBEL T100 / EOS 3000D / EOS 4000D firmware version 1.0.0 and earlier, EOS R firmware version 1.3.0 and earlier, EOS RP firmware version 1.2.0 and earlier, EOS RP GOLD firmware version 1.2.0 and earlier, EOS M2 firmware version 1.0.3 and earlier, EOS M3 firmware version 1.2.0 and earlier, EOS M5 firmware version 1.0.1 and earlier, EOS M6 firmware version 1.0.1 and earlier, EOS M6(China) firmware version 5.0.0 and earlier, EOS M10 firmware version 1.1.0 and earlier, EOS M100 firmware version 1.0.0 and earlier, EOS KISS M / EOS M50 firmware version 1.0.2 and earlier) and PowerShot SX740 HS firmware version 1.0.1 and earlier, PowerShot SX70 HS firmware version 1.1.0 and earlier, and PowerShot G5Xmark II firmware version 1.0.1 and earlier allows an attacker on the same network segment to trigger the affected product being unresponsive or to execute arbitrary code on the affected product via SendObjectInfo command.

Action-Not Available
Vendor-Canon Inc.
Product-powershot_g5xmark_iieos_5d_mark_iveos_d_rebel_sl1eos_200deos_kiss_x90_firmwareeos_d_rebel_t6s_firmwareeos_rp_goldeos_7d_mark_iieos_750d_firmwareeos_250d_firmwareeos_m2eos_m5eos_d_rebel_sl2eos_kiss_x9ieos_d_rebel_t5_firmwareeos_r_firmwareeos_80deos-1d_x_mkiieos_m10_firmwareeos_250deos_1500d_firmwareeos_kiss_x9eos_m10eos_d_rebel_t6i_firmwareeos_2000deos_1300deos_d_rebel_t7i_firmwareeos_hi_firmwareeos_kiss_meos_1200d_mg_firmwareeos_d_rebel_t5_reeos_rpeos_kiss_x70_firmwareeos_kiss_x7_firmwareeos-1d_xeos_6deos_d_rebel_sl2_firmwareeos_m5_firmwareeos_m50eos_5ds_reos_kiss_x80eos_7d_mark_ii_firmwareeos_hieos_5ds_firmwareeos_760deos_d_rebel_sl3_firmwareeos_1200deos_d_rebel_t7eos_4000d_firmwareeos_8000d_firmwareeos_1300d_firmwareeos-1d_ceos_6d_firmwareeos_8000deos_d_rebel_t5ieos_kiss_x7ieos_kiss_x70eos_kiss_m_firmwareeos_6d_mark_iieos_kiss_x10eos_800deos_70deos_700deos_d_rebel_t100_firmwareeos_750deos_d_rebel_t6seos_m50_firmwareeos-1d_c_firmwareeos_d_rebel_t5eos_m100eos_d_rebel_t100eos_77dpowershot_sx740_hseos_1200d_firmwareeos_100d_firmwareeos_kiss_x80_firmwareeos_d_rebel_t5i_firmwareeos_kiss_x7eos_200d_firmwareeos_3000d_firmwareeos_kiss_x8ieos_5d_mark_iii_firmwarepowershot_g5xmark_ii_firmwareeos_m3_firmwareeos_m6\(china\)eos_kiss_x9_firmwareeos_m6_firmwareeos_kiss_x8i_firmwareeos_5ds_r_firmwareeos_3000deos_kiss_x7i_firmwareeos_kiss_x9i_firmwareeos_rp_gold_firmwarepowershot_sx740_hs_firmwareeos_d_rebel_t5_re_firmwareeos_760d_firmwareeos_5d_mark_iv_firmwareeos_m6\(china\)_firmwareeos_rp_firmwareeos_700d_firmwareeos_2000d_firmwareeos_d_rebel_sl3eos_m3eos_1500deos_d_rebel_t7_firmwareeos_6d_mark_ii_firmwareeos_100deos_d_rebel_sl1_firmwareeos_1200d_mgeos_kiss_x90eos_800d_firmwareeos_5dseos-1d_x_mkii_firmwareeos-1d_x_firmwareeos_d_rebel_t6_firmwareeos_9000d_firmwareeos_d_rebel_t6eos_reos_d_rebel_t7ipowershot_sx70_hseos_m6eos_m2_firmwareeos_kiss_x10_firmwarepowershot_sx70_hs_firmwareeos_9000deos_80d_firmwareeos_77d_firmwareeos_m100_firmwareeos_5d_mark_iiieos_4000deos_70d_firmwareeos_d_rebel_t6iEOS series digital cameras, PowerShot SX740 HS, PowerShot SX70 HS, and PowerShot G5Xmarkâ…¡
CWE ID-CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CVE-2023-0852
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.32% / 54.64%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 21:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-12649
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.44% / 62.87%
||
7 Day CHG~0.00%
Published-28 Jan, 2025 | 00:39
Updated-26 Jan, 2026 | 15:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-lbp247dw_firmwaremf451dwlbp247dwmf465dw_firmwaremf1643i_iimf452dw_firmwarelbp236dwlbp246dwmf654cdw_firmwaremf453dw_firmwaremf652cwmf452dwmf656cdw_firmwaremf455dwmf1440lbp633cdwlbp632cdwlbp1440lbp237dw_firmwaremf653cdwmf1440_firmwaremf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf462dw_firmwaremf451dw_firmwarelbp246dw_firmwaremf654cdwmf1238_ii_firmwarelbp1440_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf462dwmf465dwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera MF654Cdwi-SENSYS LBP633Cdwi-SENSYS MF655CdwColor imageCLASS MF656Cdwi-SENSYS MF657CdwSatera MF656CdwColor imageCLASS LBP632Cdwi-SENSYS LBP631CdwColor imageCLASS LBP633CdwColor imageCLASS MF654CdwColor imageCLASS MF653Cdwi-SENSYS MF651CdwColor imageCLASS MF652Cdw
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-0854
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.22% / 45.00%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 20:59
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-0855
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.22% / 45.00%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 20:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-0853
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.32% / 54.64%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 20:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-0856
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.22% / 45.00%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 21:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-2184
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.17% / 38.55%
||
7 Day CHG~0.00%
Published-11 Mar, 2024 | 00:26
Updated-28 Aug, 2024 | 20:24
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in identifier field of WSD probe request process of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF740C Series/Satera MF640C Series/Satera LBP660C Series/Satera LBP620C Series firmware v12.07 and earlier, and Satera MF750C Series/Satera LBP670C Series firmware v03.09 and earlier sold in Japan.Color imageCLASS MF740C Series/Color imageCLASS MF640C Series/Color imageCLASS X MF1127C/Color imageCLASS LBP664Cdw/Color imageCLASS LBP622Cdw/Color imageCLASS X LBP1127C firmware v12.07 and earlier, and Color imageCLASS MF750C Series/Color imageCLASS X MF1333C/Color imageCLASS LBP674Cdw/Color imageCLASS X LBP1333C firmware v03.09 and earlier sold in US.i-SENSYS MF740C Series/i-SENSYS MF640C Series/C1127i Series/i-SENSYS LBP660C Series/i-SENSYS LBP620C Series/C1127P firmware v12.07 and earlier, and i-SENSYS MF750C Series/C1333i Series/i-SENSYS LBP673Cdw/C1333P firmware v03.09 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-Satera LBP660C Seriesi-SENSYS MF740C SeriesC1127i SeriesSatera LBP620C Seriesi-SENSYS MF750C SeriesColor imageCLASS MF640C Seriesi-SENSYS MF640C SeriesSatera MF740C Seriesi-SENSYS LBP673CdwC1333i SeriesColor imageCLASS MF740C Seriesi-SENSYS LBP620C SeriesColor imageCLASS LBP664CdwColor imageCLASS MF750C SeriesSatera MF640C SeriesColor imageCLASS X LBP1127CColor imageCLASS X MF1333CC1127PC1333PColor imageCLASS X MF1127CSatera LBP670C SeriesColor imageCLASS X LBP1333CColor imageCLASS LBP622Cdwi-SENSYS LBP660C SeriesColor imageCLASS LBP674CdwSatera MF750C Seriesc1127i_seriesi-sensys_mf750c_seriesc1333i_seriesi-sensys_mf640c_seriessatera_lbp670c_seriescolor_imageclass_lbp622cdwsatera_mf740c_seriescolor_imageclass_x_lbp1127ccolor_imageclass_mf750c_seriescolor_imageclass_mf640c_seriesc1127pcolor_imageclass_x_mf1333csatera_mf640c_seriesi-sensys_lbp660c_seriescolor_imageclass_x_lbp1333ci-sensys_lbp673cdwsatera_mf750c_seriescolor_imageclass_lbp664cdwsatera_lbp660c_seriessatera_lbp620c_seriesi-sensys_lbp620c_seriescolor_imageclass_mf740c_seriescolor_imageclass_x_mf1127ccolor_imageclass_lbp674cdwc1333pi-sensys_mf740c_series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-12648
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.44% / 62.87%
||
7 Day CHG~0.00%
Published-28 Jan, 2025 | 00:39
Updated-26 Jan, 2026 | 15:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-lbp247dw_firmwaremf451dwlbp247dwmf465dw_firmwaremf1643i_iimf452dw_firmwarelbp236dwlbp246dwmf654cdw_firmwaremf453dw_firmwaremf652cwmf452dwmf656cdw_firmwaremf455dwmf1440lbp633cdwlbp632cdwlbp1440lbp237dw_firmwaremf653cdwmf1440_firmwaremf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf462dw_firmwaremf451dw_firmwarelbp246dw_firmwaremf654cdwmf1238_ii_firmwarelbp1440_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf462dwmf465dwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera MF654Cdwi-SENSYS LBP633Cdwi-SENSYS MF655CdwColor imageCLASS MF656Cdwi-SENSYS MF657CdwSatera MF656CdwColor imageCLASS LBP632Cdwi-SENSYS LBP631CdwColor imageCLASS LBP633CdwColor imageCLASS MF654CdwColor imageCLASS MF653Cdwi-SENSYS MF651CdwColor imageCLASS MF652Cdw
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-12647
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.44% / 62.87%
||
7 Day CHG~0.00%
Published-28 Jan, 2025 | 00:38
Updated-26 Jan, 2026 | 15:08
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-lbp247dw_firmwaremf451dwlbp247dwmf465dw_firmwaremf1643i_iimf452dw_firmwarelbp236dwlbp246dwmf654cdw_firmwaremf453dw_firmwaremf652cwmf452dwmf656cdw_firmwaremf455dwmf1440lbp633cdwlbp632cdwlbp1440lbp237dw_firmwaremf653cdwmf1440_firmwaremf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf462dw_firmwaremf451dw_firmwarelbp246dw_firmwaremf654cdwmf1238_ii_firmwarelbp1440_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf462dwmf465dwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera MF654Cdwi-SENSYS LBP633Cdwi-SENSYS MF655CdwColor imageCLASS MF656Cdwi-SENSYS MF657CdwSatera MF656CdwColor imageCLASS LBP632Cdwi-SENSYS LBP631CdwColor imageCLASS LBP633CdwColor imageCLASS MF654CdwColor imageCLASS MF653Cdwi-SENSYS MF651CdwColor imageCLASS MF652Cdw
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-0851
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.32% / 54.64%
||
7 Day CHG~0.00%
Published-11 May, 2023 | 00:00
Updated-10 Feb, 2025 | 20:58
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_x_c1127ii-sensys_mf645cx_firmwaremf741cdw_firmwarei-sensys_x_c1127pmf745cdwimageprograf_tc-20mi-sensys_mf746cx_firmwaremf273dw_firmwarei-sensys_mf641cw_firmwaremf641cwimageprograf_tc-20m_firmwaremf1127c_firmwarei-sensys_mf641cwi-sensys_lbp623cdwlbp1127cmf275dwlbp621c_firmwaremaxify_gx4020lbp122dwmf262dw_iilbp622cdw_firmwarei-sensys_lbp623cdw_firmwaremf743cdwlbp661c_firmwaremaxify_gx3020mf746cdwmf644cdw_firmwaremf267dw_ii_firmwarelbp1127c_firmwaremf1127clbp622c_firmwaremf269dw_iimf745cdw_firmwarei-sensys_mf746cximageprograf_tc-20_firmwarei-sensys_mf744cdwmf269dw_vp_ii_firmwarelbp662c_firmwaremf642cdw_firmwaremf746cdw_firmwarei-sensys_x_c1127p_firmwaremf273dwi-sensys_x_c1127i_firmwareimageprograf_tc-20i-sensys_lbp621cwi-sensys_x_c1127ifi-sensys_x_c1127if_firmwaremf272dw_firmwaremf644cdwi-sensys_lbp664cxlbp664cdw_firmwarepixma_g4270pixma_g3270i-sensys_mf645cxi-sensys_lbp633cdw_firmwarei-sensys_mf744cdw_firmwarelbp623cdw_firmwarepixma_g4270_firmwarelbp622cpixma_g3270_firmwarei-sensys_mf643cdw_firmwaremaxify_gx4020_firmwarei-sensys_lbp621cw_firmwaremf272dwmf641cw_firmwarelbp622cdwlbp664c_firmwarei-sensys_lbp633cdwmf264dw_iimf642cdwmf264dw_ii_firmwarelbp662clbp621ci-sensys_mf742cdw_firmwaremf262dw_ii_firmwarelbp122dw_firmwarelbp661ci-sensys_mf742cdwmf743cdw_firmwarelbp664cdwmf269dw_ii_firmwarei-sensys_mf643cdwmf269dw_vp_iii-sensys_lbp664cx_firmwaremf275dw_firmwarelbp664cmf267dw_iimaxify_gx3020_firmwaremf741cdwlbp623cdwCanon Office/Small Office Multifunction Printers and Laser Printers
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2024-0244
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.45% / 63.06%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:24
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwlbp1333c_firmwarelbp1333cmf755cdwi-sensys_mf754cdwmf1333c_firmwaremf751cdw_firmwarei-sensys_x_c1333ifmf755cdw_firmwaremf753cdwmf753cdw_firmwarei-sensys_x_c1333if_firmwaremf1333cColor imageCLASS MF750C SeriesC1333iFSatera MF750C Seriesi-SENSYS MF754CdwColor imageCLASS X MF1333C
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6234
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.49% / 65.03%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:23
Updated-02 Aug, 2024 | 08:21
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiColor imageCLASS LBP674CColor imageCLASS MF750C SeriesColor imageCLASS X MF1333C Seriesi-SENSYS MF750C Seriesi-SENSYS LBP673CdwC1333PSatera LBP670C SeriesColor imageCLASS X LBP1333CC1333i SeriesSatera MF750C Seriesmf750ci-sensys_lbp673cdwi-sensys_x_c1333plbp1333clbp674cmf1333c
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6229
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.49% / 65.03%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:20
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiSatera LBP670C SeriesColor imageCLASS MF750C SeriesC1333i SeriesColor imageCLASS LBP674CColor imageCLASS X MF1333C SeriesSatera MF750C Seriesi-SENSYS LBP673Cdwi-SENSYS MF750C SeriesColor imageCLASS X LBP1333CC1333P
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6230
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.36% / 57.90%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:21
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiSatera LBP670C SeriesColor imageCLASS MF750C SeriesC1333i SeriesColor imageCLASS LBP674CColor imageCLASS X MF1333C SeriesSatera MF750C Seriesi-SENSYS LBP673Cdwi-SENSYS MF750C SeriesColor imageCLASS X LBP1333CC1333P
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6232
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.36% / 57.90%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:22
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiSatera LBP670C SeriesColor imageCLASS MF750C SeriesC1333i SeriesColor imageCLASS LBP674CColor imageCLASS X MF1333C SeriesSatera MF750C Seriesi-SENSYS LBP673Cdwi-SENSYS MF750C SeriesColor imageCLASS X LBP1333CC1333P
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6233
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.31% / 54.13%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:23
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiSatera LBP670C SeriesColor imageCLASS MF750C SeriesC1333i SeriesColor imageCLASS LBP674CColor imageCLASS X MF1333C SeriesSatera MF750C Seriesi-SENSYS LBP673Cdwi-SENSYS MF750C SeriesColor imageCLASS X LBP1333CC1333P
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-6231
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.31% / 54.13%
||
7 Day CHG~0.00%
Published-06 Feb, 2024 | 00:22
Updated-17 Jun, 2025 | 21:29
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-i-sensys_mf754cdw_firmwaremf751cdwmf273dw_firmwarelbp671cmf1238_iilbp672c_firmwaremf1643i_ii_firmwarei-sensys_x_c1333i_firmwaremf1333clbp236dw_firmwaremf275dwi-sensys_x_c1333p_firmwarelbp122dwi-sensys_x_c1333imf1643if_iimf272dwlbp671c_firmwaremf451dw_firmwarelbp674cdwlbp672ci-sensys_mf754cdwmf1333c_firmwaremf753cdwi-sensys_x_c1333if_firmwarei-sensys_mf752cdwi-sensys_x_c1333pmf453dwmf452dwmf455dw_firmwarelbp1333c_firmwarelbp122dw_firmwarelbp674c_firmwaremf455dwmf755cdw_firmwaremf452dw_firmwaremf451dwlbp237dw_firmwaremf753cdw_firmwarelbp674cdw_firmwarei-sensys_x_c1333ifi-sensys_lbp673cdw_firmwarei-sensys_lbp673cdwmf273dwlbp1238_iimf275dw_firmwarelbp1238_ii_firmwarelbp1333cmf755cdwmf453dw_firmwaremf1238_ii_firmwarelbp236dwi-sensys_mf752cdw_firmwaremf751cdw_firmwaremf272dw_firmwarelbp674cmf1643if_ii_firmwarelbp237dwmf1643i_iiSatera LBP670C SeriesColor imageCLASS MF750C SeriesC1333i SeriesColor imageCLASS LBP674CColor imageCLASS X MF1333C SeriesSatera MF750C Seriesi-SENSYS LBP673Cdwi-SENSYS MF750C SeriesColor imageCLASS X LBP1333CC1333P
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-2146
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.8||CRITICAL
EPSS-0.37% / 58.08%
||
7 Day CHG~0.00%
Published-25 May, 2025 | 23:36
Updated-03 Jun, 2025 | 15:49
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-imageclass_mf653cdw_firmwareimagerunner_1643if_iiimageclass_mf656cdw_firmwarei-sensys_lbp233dw_firmwarei-sensys_mf453dwsatera_mf457dwi-sensys_mf655cdw_firmwarei-sensys_lbp233dwi-sensys_mf657cdw_firmwarei-sensys_x_1238pr_ii_firmwareimageclass_mf455dw_firmwarei-sensys_lbp631cdw_firmwareimageclass_mf451dw_firmwarei-sensys_mf651cdw_firmwarei-sensys_mf552dw_firmwareimageclass_mf452dw_firmwarei-sensys_mf455dw_firmwareimageclass_x_mf1643i_iiimageclass_mf455dwsatera_mf551dwi-sensys_x_1238p_iiimageclass_mf653cdwi-sensys_lbp236dw_firmwarei-sensys_mf455dwimageclass_x_lbp1238_iiimageclass_lbp632cdw_firmwaresatera_mf656cdw_firmwareimageclass_mf652cdw_firmwareimageclass_mf451dwimageclass_lbp236dwimageclass_mf452dwi-sensys_x_1238pr_iiimageclass_x_mf1643if_iii-sensys_lbp633cdw_firmwareimageclass_lbp237dw_firmwareimagerunner_1643if_ii_firmwarei-sensys_mf657cdwi-sensys_lbp236dwi-sensys_x_1238p_ii_firmwareimageclass_mf453dw_firmwarei-sensys_mf651cdwi-sensys_mf453dw_firmwarei-sensys_x_1238if_iii-sensys_lbp631cdwsatera_mf551dw_firmwareimageclass_x_mf1238_iisatera_mf654cdwimagerunner_1643i_iiimageclass_mf652cdwi-sensys_mf553dw_firmwareimageclass_mf656cdwi-sensys_lbp633cdwimagerunner_1643i_ii_firmwarei-sensys_x_1238i_ii_firmwareimageclass_x_mf1238_ii_firmwareimageclass_lbp237dwimageclass_x_mf1643i_ii_firmwareimageclass_mf654cdw_firmwareimageclass_mf654cdwi-sensys_mf553dwi-sensys_x_1238if_ii_firmwaresatera_mf654cdw_firmwarei-sensys_x_1238i_iiimageclass_mf453dwimageclass_lbp633cdwimageclass_x_lbp1238_ii_firmwareimageclass_lbp633cdw_firmwaresatera_mf656cdwimageclass_x_mf1643if_ii_firmwaresatera_mf457dw_firmwareimageclass_lbp236dw_firmwareimageclass_lbp632cdwi-sensys_mf655cdwi-sensys_mf552dwimageCLASS MF453dwSatera MF457dwimageCLASS MF455dwi-SENSYS MF655Cdwi-SENSYS MF455dwi-SENSYS X 1238P IIimageCLASS X MF1643i IIimageCLASS X MF1643iF IIi-SENSYS MF453dwColor imageCLASS MF656CdwimageCLASS X MF1238 IIi-SENSYS X 1238iF IIimageCLASS MF451dwColor imageCLASS MF654Cdwi-SENSYS MF651Cdwi-SENSYS MF553dwi-SENSYS MF552dwimageCLASS LBP237dwColor imageCLASS MF653CdwimageRUNNER 1643iF IIi-SENSYS LBP233dwColor imageCLASS LBP633Cdwi-SENSYS X 1238Pr IIColor imageCLASS MF652Cdwi-SENSYS X 1238i IIColor imageCLASS LBP632Cdwi-SENSYS LBP633CdwimageCLASS MF452dwi-SENSYS LBP236dwSatera MF551dwi-SENSYS MF657CdwSatera MF656CdwimageCLASS LBP236dwSatera MF654CdwimageCLASS X LBP1238 IIi-SENSYS LBP631CdwimageRUNNER 1643i II
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14232
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:36
Updated-26 Jan, 2026 | 15:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwaremf455dwlbp633cdwlbp632cdwlbp237dw_firmwaremf653cdwmf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14234
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:38
Updated-26 Jan, 2026 | 15:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwaremf455dwlbp633cdwlbp632cdwlbp237dw_firmwaremf653cdwmf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14235
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:38
Updated-26 Jan, 2026 | 15:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwarelbp633cdwlbp632cdwmf455dwlbp237dw_firmwaremf653cdwmf652cw_firmwarelbp236dw_firmwaremf455dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14231
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:35
Updated-26 Jan, 2026 | 15:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwaremf455dwlbp633cdwlbp632cdwlbp237dw_firmwaremf653cdwmf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14236
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:39
Updated-26 Jan, 2026 | 15:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwaremf455dwlbp633cdwlbp632cdwlbp237dw_firmwaremf653cdwmf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2025-14237
Matching Score-6
Assigner-Canon Inc.
ShareView Details
Matching Score-6
Assigner-Canon Inc.
CVSS Score-9.3||CRITICAL
EPSS-0.10% / 28.45%
||
7 Day CHG~0.00%
Published-15 Jan, 2026 | 23:40
Updated-26 Jan, 2026 | 15:11
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

Action-Not Available
Vendor-Canon Inc.
Product-mf451dwmf1643i_iimf452dw_firmwarelbp236dwmf654cdw_firmwaremf453dw_firmwaremf452dwmf656cdw_firmwaremf455dwlbp633cdwlbp632cdwlbp237dw_firmwaremf653cdwmf652cw_firmwaremf455dw_firmwarelbp236dw_firmwaremf1643if_iimf653cdw_firmwarelbp632cdw_firmwaremf656cdwmf1643i_ii_firmwaremf453dwmf451dw_firmwaremf654cdwmf1238_ii_firmwaremf1238_iilbp237dwlbp633cdw_firmwarelbp1238_iimf652cdwlbp1238_ii_firmwaremf1643if_ii_firmwareSatera LBP670C SeriesimageCLASS X LBP1238 IIimageCLASS X MF1643iF IIi-SENSYS LBP230 Seriesi-SENSYS MF550 Series1238Pr IIi-SENSYS LBP630C Seriesi-SENSYS MF450 SeriesSatera MF750C SeriesColor imageCLASS MF650C Seriesi-SENSYS MF650C SeriesimageCLASS X MF1643i IIimageRUNNER 1643i IIColor imageCLASS LBP630C1238iF IIimageCLASS X MF1238 IIimageRUNNER 1643iF II1238i II1238P IIimageCLASS MF450 SeriesimageCLASS LBP230 Series
CWE ID-CWE-787
Out-of-bounds Write
CVE-2020-3415
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-8.8||HIGH
EPSS-0.21% / 43.71%
||
7 Day CHG~0.00%
Published-27 Aug, 2020 | 15:40
Updated-13 Nov, 2024 | 18:10
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cisco NX-OS Software Data Management Engine Remote Code Execution Vulnerability

A vulnerability in the Data Management Engine (DME) of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to execute arbitrary code with administrative privileges or cause a denial of service (DoS) condition on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to execute arbitrary code with administrative privileges or cause the Cisco Discovery Protocol process to crash and restart multiple times, causing the affected device to reload and resulting in a DoS condition. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Exploitation of this vulnerability also requires jumbo frames to be enabled on the interface that receives the crafted Cisco Discovery Protocol packets on the affected device.

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-nexus_93180lc-exnexus_9332pqnexus_3172tqnexus_93108tc-exnx-osnexus_3636c-rnexus_9508nexus_93120txnexus_93128txnexus_9336pq_aci_spinenexus_3548-xlnexus_31128pqnexus_3132q-vnexus_9332cnexus_9364cnexus_3164qnexus_92348gc-xnexus_3172tq-32tnexus_9336c-fx2nexus_3132c-znexus_3524-xnexus_31108tc-vnexus_9348gc-fxpnexus_3172nexus_9272qnexus_3464cnexus_93216tc-fx2nexus_36180yc-rnexus_93180yc-fxnexus_3264qnexus_3432d-sucs_6454nexus_34180ycnexus_31108pc-vnexus_3524nexus_3548nexus_3132qnexus_3016nexus_9372pxucs_64108nexus_92304qcnexus_92160yc-xnexus_9504nexus_3048nexus_9372tx-enexus_93108tc-fxnexus_93360yc-fx2nexus_3524-xlnexus_9396txnexus_92300ycnexus_3064nexus_3232cnexus_9396pxnexus_3264c-enexus_93240yc-fx2nexus_9372txnexus_3548-xnexus_3132q-xlnexus_3064-tnexus_3172tq-xlnexus_93180yc-exnexus_3408-snexus_9372px-enexus_9236cnexus_9516nexus_3172pq-xlCisco NX-OS Software
CWE ID-CWE-787
Out-of-bounds Write
CVE-2020-3118
Matching Score-4
Assigner-Cisco Systems, Inc.
ShareView Details
Matching Score-4
Assigner-Cisco Systems, Inc.
CVSS Score-8.8||HIGH
EPSS-0.29% / 52.26%
||
7 Day CHG~0.00%
Published-05 Feb, 2020 | 17:40
Updated-28 Oct, 2025 | 13:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2022-05-03||Apply updates per vendor instructions.
Cisco IOS XR Software Cisco Discovery Protocol Format String Vulnerability

A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow, which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability, an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).

Action-Not Available
Vendor-Cisco Systems, Inc.
Product-ncs_540-12z20g-sys-dncs_5516asr_9006asr_9903asr_9904asr_9901ncs_5501-sencs_540lasr_9920ncs_540-28z4c-sys-ancs_540x-12z16g-sys-dncs_5501crs-xasr_9000vasr_9910xrv_9000ncs_540x-12z16g-sys-aasr_9912ncs_540x-16z4g8q2c-dasr_9906ncs_5502-sencs_560asr_9010asr_9001ios_xrncs_540-acc-sysncs_540-28z4c-sys-dncs_5502ncs_6008asr_9000ncs_540x-acc-sysncs_6000ncs_540x-16z4g8q2c-ancs_5508ncs_540-12z20g-sys-ancs_540-24z8q2c-sysasr_9922Cisco IOS XR SoftwareIOS XR
CWE ID-CWE-134
Use of Externally-Controlled Format String
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41202
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:11
Updated-12 Mar, 2025 | 17:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetAPLanSettings Mode Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings Mode Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18828.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41203
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:11
Updated-12 Mar, 2025 | 17:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetAPLanSettings PrimaryDNS Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings PrimaryDNS Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18829.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41211
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetHostIPv6StaticSettings StaticPrefixLength Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetHostIPv6StaticSettings StaticPrefixLength Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18837.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41213
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18840.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41205
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetAPLanSettings SubnetMask Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings SubnetMask Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18831.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2020-28373
Matching Score-4
Assigner-MITRE Corporation
ShareView Details
Matching Score-4
Assigner-MITRE Corporation
CVSS Score-8.8||HIGH
EPSS-0.11% / 29.52%
||
7 Day CHG~0.00%
Published-09 Nov, 2020 | 21:32
Updated-04 Aug, 2024 | 16:33
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

upnpd on certain NETGEAR devices allows remote (LAN) attackers to execute arbitrary code via a stack-based buffer overflow. This affects R6400v2 V1.0.4.102_10.0.75, R6400 V1.0.1.62_1.0.41, R7000P V1.3.2.126_10.1.66, XR300 V1.0.3.50_10.3.36, R8000 V1.0.4.62, R8300 V1.0.2.136, R8500 V1.0.2.136, R7300DST V1.0.0.74, R7850 V1.0.5.64, R7900 V1.0.4.30, RAX20 V1.0.2.64, RAX80 V1.0.3.102, and R6250 V1.0.4.44.

Action-Not Available
Vendor-n/aNETGEAR, Inc.
Product-r8500rax80r7850_firmwarer8300_firmwarer6400v2r8000xr300r6400_firmwarerax80_firmwarer7900r7000pr6250r6400v2_firmwarer8300r8500_firmwarer7300dst_firmwarexr300_firmwarer7900_firmwarer7850rax20r7300dstr6400rax20_firmwarer6250_firmwarer8000_firmwarer7000p_firmwaren/a
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41209
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS1 Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetHostIPv6StaticSettings StaticDNS1 Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18835.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41212
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:38
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetTriggerAPValidate Key Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetTriggerAPValidate Key Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18839.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41214
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:40
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 setDhcpAssignRangeUpdate lan_ipaddr Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18841.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41230
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-7.5||HIGH
EPSS-0.78% / 73.32%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-15 May, 2025 | 12:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DIR-3040 HTTP Request Processing Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability

D-Link DIR-3040 HTTP Request Processing Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a fixed size stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21674.

Action-Not Available
Vendor-D-Link Corporation
Product-dir-3040_firmwaredir-3040DIR-3040dir-3040
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2026-20408
Matching Score-4
Assigner-MediaTek, Inc.
ShareView Details
Matching Score-4
Assigner-MediaTek, Inc.
CVSS Score-8.8||HIGH
EPSS-0.01% / 1.95%
||
7 Day CHG~0.00%
Published-02 Feb, 2026 | 08:14
Updated-04 Feb, 2026 | 13:48
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In wlan, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00461651; Issue ID: MSV-4758.

Action-Not Available
Vendor-MediaTek Inc.OpenWrt
Product-software_development_kitopenwrtmt6890mt7986mt7615mt7916mt7981mt7915MT6890, MT7615, MT7915, MT7916, MT7981, MT7986
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41207
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:37
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetHostIPv6StaticSettings StaticAddress Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetHostIPv6StaticSettings StaticAddress Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18833.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41229
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-0.52% / 66.16%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-15 May, 2025 | 12:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability

D-Link DIR-3040 HTTP Request Processing Referer Heap-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-3040 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the prog.cgi binary, which handles HNAP requests made to the lighttpd webserver listening on TCP ports 80 and 443. The issue results from the lack of proper validation of a user-supplied string before copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-21671.

Action-Not Available
Vendor-D-Link Corporation
Product-dir-3040_firmwaredir-3040DIR-3040dir-3040_firmware
CWE ID-CWE-122
Heap-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-41204
Matching Score-4
Assigner-Zero Day Initiative
ShareView Details
Matching Score-4
Assigner-Zero Day Initiative
CVSS Score-8.8||HIGH
EPSS-2.77% / 85.72%
||
7 Day CHG~0.00%
Published-03 May, 2024 | 02:12
Updated-12 Mar, 2025 | 17:36
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
D-Link DAP-1325 SetAPLanSettings SecondaryDNS Stack-based Buffer Overflow Remote Code Execution Vulnerability

D-Link DAP-1325 SetAPLanSettings SecondaryDNS Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of XML data provided to the HNAP1 SOAP endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-18830.

Action-Not Available
Vendor-D-Link Corporation
Product-dap-1325_firmwaredap-1325DAP-1325dap-1325_firmware
CWE ID-CWE-121
Stack-based Buffer Overflow
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-40129
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-8.8||HIGH
EPSS-0.05% / 15.92%
||
7 Day CHG+0.01%
Published-27 Oct, 2023 | 20:22
Updated-09 Sep, 2024 | 14:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

Action-Not Available
Vendor-Google LLC
Product-androidAndroidandroid
CWE ID-CWE-787
Out-of-bounds Write
CVE-2021-3330
Matching Score-4
Assigner-Zephyr Project
ShareView Details
Matching Score-4
Assigner-Zephyr Project
CVSS Score-7.1||HIGH
EPSS-0.11% / 29.42%
||
7 Day CHG~0.00%
Published-12 Oct, 2021 | 21:50
Updated-17 Sep, 2024 | 01:00
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr

RCE/DOS: Linked-list corruption leading to large out-of-bounds write while sorting for forged fragment list in Zephyr. Zephyr versions >= >=2.4.0 contain Out-of-bounds Write (CWE-787). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-fj4r-373f-9456

Action-Not Available
Vendor-Zephyr Project
Product-zephyrzephyr
CWE ID-CWE-787
Out-of-bounds Write
CVE-2023-40087
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
ShareView Details
Matching Score-4
Assigner-Android (associated with Google Inc. or Open Handset Alliance)
CVSS Score-8.8||HIGH
EPSS-0.08% / 23.41%
||
7 Day CHG~0.00%
Published-04 Dec, 2023 | 22:40
Updated-28 Aug, 2024 | 17:44
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

In transcodeQ*ToFloat of btif_avrcp_audio_track.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Action-Not Available
Vendor-Google LLC
Product-androidAndroid
CWE ID-CWE-787
Out-of-bounds Write
  • Previous
  • 1
  • 2
  • 3
  • ...
  • 6
  • 7
  • Next
Details not found