CVE-2018-12048: Critical severity canon lbp7110cw firmware vulnerability

Published Jun 8, 2018

Updated

DISPUTED A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation.

Affected Software

4 affected components

All of the following

Canon Lbp7110cw Firmware

Canon LBP7110Cw

Canon Lbp7110cw Firmware

Canon LBP7110Cw

Event History

Jun 8, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Disputed

01:29 AM

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID of this issue is CVE-2018-12048.

What is the severity of CVE-2018-12048?

CVE-2018-12048 has a severity rating of 9.8 (Critical).

What is the affected software?

The affected software is Canon Lbp7110cw Firmware.

How can a remote attacker exploit CVE-2018-12048?

A remote attacker can exploit CVE-2018-12048 by bypassing the Management Mode on the Canon LBP7110Cw web interface without a PIN.

Is there a fix available for CVE-2018-12048?

The vendor reportedly responded that this issue occurs when a customer keeps the default configuration, so it is recommended to change the default settings to mitigate the risk.