CVE-2018-12049: Critical severity canon lbp6030w firmware vulnerability

Published Jun 8, 2018

Updated

DISPUTED A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portaltop.html to get full access to the device. NOTE: the vendor reportedly responded that this issue occurs when a customer keeps the default settings without using the countermeasures and best practices shown in the documentation.

Affected Software

4 affected components

Canon Lbp6030w Firmware

Canon LBP6030w

All of the following

Canon Lbp6030w Firmware

Canon LBP6030w

Event History

Jun 8, 2018

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Disputed

01:29 AM

Frequently Asked Questions

What is CVE-2018-12049?

CVE-2018-12049 is a vulnerability that allows a remote attacker to bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN, gaining full access to the device.

How can the System Manager Mode be bypassed on the Canon LBP6030w web interface?

The System Manager Mode can be bypassed on the Canon LBP6030w web interface without a PIN by exploiting vectors involving /portal_top.html and /checkLogin.cgi.

What can an attacker do if they gain full access to the Canon LBP6030w device?

If an attacker gains full access to the Canon LBP6030w device, they can have complete control over it.

Is there a fix available for CVE-2018-12049?

The vendor has not provided a fix for CVE-2018-12049.

What is the severity of CVE-2018-12049?

CVE-2018-12049 has a severity rating of 9.8 (Critical).