ZDI-CAN-22391: ZDI-24-090: (Pwn2Own) Canon imageCLASS MF753Cdw rls-login Authorization Stack-based Buffer Overflow Remote Code Execution Vulnerability

Published Feb 6, 2024

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF753Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2023-6230.

Affected Software

1 affected component

Canon imageCLASS MF753Cdw

Event History

Feb 6, 2024

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-22391?

The severity of ZDI-CAN-22391 is rated at 8.8 on the CVSS scale, indicating a critical vulnerability.

How do I fix ZDI-CAN-22391?

To fix ZDI-CAN-22391, update the firmware of your Canon imageCLASS MF753Cdw printer to the latest version provided by Canon.

Who is affected by ZDI-CAN-22391?

ZDI-CAN-22391 affects installations of Canon imageCLASS MF753Cdw printers.

Can ZDI-CAN-22391 be exploited without authentication?

Yes, ZDI-CAN-22391 can be exploited by network-adjacent attackers without the need for authentication.

What type of attack does ZDI-CAN-22391 allow?

ZDI-CAN-22391 allows attackers to execute arbitrary code on affected Canon printers.