ZDI-CAN-22386: ZDI-24-092: (Pwn2Own) Canon imageCLASS MF753Cdw rls-login Authorization Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Feb 6, 2024

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF753Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-6232.

Affected Software

1 affected component

Canon imageCLASS MF753Cdw

Event History

Feb 6, 2024

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-22386?

The severity of ZDI-CAN-22386 is rated at 8.8 on the CVSS scale, indicating a high level of risk.

How do I fix ZDI-CAN-22386?

To fix ZDI-CAN-22386, update the Canon imageCLASS MF753Cdw printer firmware to the latest version provided by Canon.

Who is affected by ZDI-CAN-22386?

Organizations using Canon imageCLASS MF753Cdw printers are affected by ZDI-CAN-22386.

Can ZDI-CAN-22386 be exploited remotely?

Yes, ZDI-CAN-22386 can be exploited by network-adjacent attackers without requiring authentication.

What type of attack does ZDI-CAN-22386 allow?

ZDI-CAN-22386 allows attackers to execute arbitrary code on vulnerable installations of Canon imageCLASS MF753Cdw printers.