ZDI-CAN-25490: ZDI-25-073: (Pwn2Own) Canon imageCLASS MF656Cdw listObjects2 Buffer Overflow Remote Code Execution Vulnerability

Published Jan 31, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF656Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-12647.

Affected Software

1 affected component

Canon imageCLASS MF656Cdw

Event History

Jan 31, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25490?

The vulnerability ZDI-CAN-25490 has a CVSS rating of 8.8, indicating it is highly severe.

How do I fix ZDI-CAN-25490?

To fix ZDI-CAN-25490, ensure that your Canon imageCLASS MF656Cdw printer firmware is updated to the latest version provided by Canon.

Who is affected by ZDI-CAN-25490?

The vulnerability ZDI-CAN-25490 affects installations of Canon imageCLASS MF656Cdw printers.

Can ZDI-CAN-25490 be exploited remotely?

Yes, ZDI-CAN-25490 can be exploited by network-adjacent attackers without the need for authentication.

What kind of access does ZDI-CAN-25490 provide to attackers?

ZDI-CAN-25490 allows attackers to execute arbitrary code on the affected Canon imageCLASS MF656Cdw printers.