CVE-2024-0244

Vulnerability

A buffer overflow vulnerability exists in the CPCA PCFAX number processing of Canon Office Multifunction Printers and Laser Printers. This affects Satera MF750C Series firmware v03.07 and earlier (Japan), Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier (US), and i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier (Europe) [1]. The flaw is triggered by specially crafted data sent to the device's fax number handling routine.

Exploitation

An attacker on the same network segment (i.e., without going through a wired or Wi-Fi router) can trigger this vulnerability by sending a maliciously crafted PCFAX number to the affected printer. No authentication is required, but the attacker must be able to communicate with the printer on the local network [1]. The vulnerability is exploitable over the network without user interaction.

Impact

Successful exploitation could render the device unresponsive (denial of service) or allow the attacker to execute arbitrary code on the device [1]. This gives the attacker control over the printer's functionality and may lead to further network compromise.

Mitigation

Canon has released firmware updates to address this vulnerability. Users should upgrade to the latest firmware version for their device. As of the advisory date, no workarounds are mentioned [1]. The vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.