ZDI-24-094: (Pwn2Own) Canon imageCLASS MF753Cdw CADM setResource Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Feb 6, 2024

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF753Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-6234.

Affected Software

1 affected component

Canon imageCLASS MF753Cdw

Event History

Feb 6, 2024

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-24-094?

The severity of ZDI-24-094 is rated at 8.8 according to CVSS.

How do I fix ZDI-24-094?

To fix ZDI-24-094, update the Canon imageCLASS MF753Cdw printer firmware to the latest version provided by Canon.

Who can exploit ZDI-24-094?

Network-adjacent attackers can exploit ZDI-24-094 without requiring authentication.

What type of vulnerability is ZDI-24-094?

ZDI-24-094 is a remote code execution vulnerability affecting Canon imageCLASS MF753Cdw printers.

What are the potential consequences of ZDI-24-094?

The exploitation of ZDI-24-094 may allow attackers to execute arbitrary code on the affected printer.