ZDI-CAN-25622: ZDI-25-075: (Pwn2Own) Canon imageCLASS MF656Cdw TTF Parsing Write-What-Where Condition Remote Code Execution Vulnerability

Published Jan 31, 2025

Updated

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF656Cdw printers. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 8.8. The following CVEs are assigned: CVE-2024-12649.

Affected Software

1 affected component

Canon imageCLASS MF656Cdw

Event History

Jan 31, 2025

Advisory Published

via ZDI·06:00 AM

Data Sourced

via ZDI·06:00 AM

Description

Frequently Asked Questions

What is the severity of ZDI-CAN-25622?

The severity of ZDI-CAN-25622 is rated at 8.8, indicating a high level of risk.

How do I fix ZDI-CAN-25622?

To fix ZDI-CAN-25622, update the firmware of the Canon imageCLASS MF656Cdw printer to the latest version provided by Canon.

Who is affected by ZDI-CAN-25622?

ZDI-CAN-25622 affects installations of Canon imageCLASS MF656Cdw printers.

Can ZDI-CAN-25622 be exploited remotely?

Yes, ZDI-CAN-25622 can be exploited by network-adjacent attackers without the need for authentication.

What kind of attack is possible with ZDI-CAN-25622?

ZDI-CAN-25622 allows attackers to execute arbitrary code on the affected printer installations.