This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00132.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Canon imageCLASS MF644Cdw affected
Version Status Constraints
10.02 affected —

Configuration 1 [-]

AND
cpe:2.3:o:canon:d1620_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:d1620:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:canon:d1650_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:d1650:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND
cpe:2.3:o:canon:d1520_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:d1520:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND
cpe:2.3:o:canon:d1550_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:d1550:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND
cpe:2.3:o:canon:mf1127c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf1127c:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND
cpe:2.3:o:canon:mf1238_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf1238:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND
cpe:2.3:o:canon:mf1238_ii_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND
cpe:2.3:o:canon:mf1643i_ii_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND
cpe:2.3:o:canon:mf1643if_ii_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND
cpe:2.3:o:canon:mf414dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf414dw:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND
cpe:2.3:o:canon:mf416dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf416dw:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND
cpe:2.3:o:canon:mf419dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf419dw:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND
cpe:2.3:o:canon:mf515dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf515dw:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND
cpe:2.3:o:canon:mf424dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf424dw:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND
cpe:2.3:o:canon:mf426dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf426dw:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND
cpe:2.3:o:canon:mf429dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf429dw:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND
cpe:2.3:o:canon:mf525dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf525dw:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND
cpe:2.3:o:canon:mf445dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf445dw:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND
cpe:2.3:o:canon:mf448dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf448dw:-:*:*:*:*:*:*:*

Configuration 20 [-]

AND
cpe:2.3:o:canon:mf449dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf449dw:-:*:*:*:*:*:*:*

Configuration 21 [-]

AND
cpe:2.3:o:canon:mf543dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf543dw:-:*:*:*:*:*:*:*

Configuration 22 [-]

AND
cpe:2.3:o:canon:mf451dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:*

Configuration 23 [-]

AND
cpe:2.3:o:canon:mf452dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:*

Configuration 24 [-]

AND
cpe:2.3:o:canon:mf453dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:*

Configuration 25 [-]

AND
cpe:2.3:o:canon:mf455dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*

Configuration 26 [-]

AND
cpe:2.3:o:canon:mf6160dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf6160dw:-:*:*:*:*:*:*:*

Configuration 27 [-]

AND
cpe:2.3:o:canon:mf6180dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf6180dw:-:*:*:*:*:*:*:*

Configuration 28 [-]

AND
cpe:2.3:o:canon:mf624cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf624cdw:-:*:*:*:*:*:*:*

Configuration 29 [-]

AND
cpe:2.3:o:canon:mf628cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf628cdw:-:*:*:*:*:*:*:*

Configuration 30 [-]

AND
cpe:2.3:o:canon:mf632cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf632cdw:-:*:*:*:*:*:*:*

Configuration 31 [-]

AND
cpe:2.3:o:canon:mf634cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf634cdw:-:*:*:*:*:*:*:*

Configuration 32 [-]

AND
cpe:2.3:o:canon:mf641cw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf641cw:-:*:*:*:*:*:*:*

Configuration 33 [-]

AND
cpe:2.3:o:canon:mf642cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf642cdw:-:*:*:*:*:*:*:*

Configuration 34 [-]

AND
cpe:2.3:o:canon:mf644cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf644cdw:-:*:*:*:*:*:*:*

Configuration 35 [-]

AND
cpe:2.3:o:canon:mf726cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf726cdw:-:*:*:*:*:*:*:*

Configuration 36 [-]

AND
cpe:2.3:o:canon:mf729cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf729cdw:-:*:*:*:*:*:*:*

Configuration 37 [-]

AND
cpe:2.3:o:canon:mf731cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf731cdw:-:*:*:*:*:*:*:*

Configuration 38 [-]

AND
cpe:2.3:o:canon:mf733cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf733cdw:-:*:*:*:*:*:*:*

Configuration 39 [-]

AND
cpe:2.3:o:canon:mf735cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf735cdw:-:*:*:*:*:*:*:*

Configuration 40 [-]

AND
cpe:2.3:o:canon:mf741cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf741cdw:-:*:*:*:*:*:*:*

Configuration 41 [-]

AND
cpe:2.3:o:canon:mf743cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf743cdw:-:*:*:*:*:*:*:*

Configuration 42 [-]

AND
cpe:2.3:o:canon:mf745cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf745cdw:-:*:*:*:*:*:*:*

Configuration 43 [-]

AND
cpe:2.3:o:canon:mf746cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf746cdw:-:*:*:*:*:*:*:*

Configuration 44 [-]

AND
cpe:2.3:o:canon:mf810cdn_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf810cdn:-:*:*:*:*:*:*:*

Configuration 45 [-]

AND
cpe:2.3:o:canon:mf820cdn_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf820cdn:-:*:*:*:*:*:*:*

Configuration 46 [-]

AND
cpe:2.3:o:canon:mf8280cw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf8280cw:-:*:*:*:*:*:*:*

Configuration 47 [-]

AND
cpe:2.3:o:canon:mf8580cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:mf8580cdw:-:*:*:*:*:*:*:*

Configuration 48 [-]

AND
cpe:2.3:o:canon:lbp1127c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp1127c:-:*:*:*:*:*:*:*

Configuration 49 [-]

AND
cpe:2.3:o:canon:lbp1238_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp1238:-:*:*:*:*:*:*:*

Configuration 50 [-]

AND
cpe:2.3:o:canon:lbp1238_ii_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:*

Configuration 51 [-]

AND
cpe:2.3:o:canon:lbp214dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp214dw:-:*:*:*:*:*:*:*

Configuration 52 [-]

AND
cpe:2.3:o:canon:lbp215dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp215dw:-:*:*:*:*:*:*:*

Configuration 53 [-]

AND
cpe:2.3:o:canon:lbp226dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp226dw:-:*:*:*:*:*:*:*

Configuration 54 [-]

AND
cpe:2.3:o:canon:lbp227dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp227dw:-:*:*:*:*:*:*:*

Configuration 55 [-]

AND
cpe:2.3:o:canon:lbp228dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp228dw:-:*:*:*:*:*:*:*

Configuration 56 [-]

AND
cpe:2.3:o:canon:lbp236dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:*

Configuration 57 [-]

AND
cpe:2.3:o:canon:lbp237dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:*

Configuration 58 [-]

AND
cpe:2.3:o:canon:lbp251dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp251dw:-:*:*:*:*:*:*:*

Configuration 59 [-]

AND
cpe:2.3:o:canon:lbp253dw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp253dw:-:*:*:*:*:*:*:*

Configuration 60 [-]

AND
cpe:2.3:o:canon:lbp612cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp612cdw:-:*:*:*:*:*:*:*

Configuration 61 [-]

AND
cpe:2.3:o:canon:lbp622cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp622cdw:-:*:*:*:*:*:*:*

Configuration 62 [-]

AND
cpe:2.3:o:canon:lbp623cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp623cdw:-:*:*:*:*:*:*:*

Configuration 63 [-]

AND
cpe:2.3:o:canon:lbp654cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp654cdw:-:*:*:*:*:*:*:*

Configuration 64 [-]

AND
cpe:2.3:o:canon:lbp664cdw_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:lbp664cdw:-:*:*:*:*:*:*:*

Configuration 65 [-]

AND
cpe:2.3:o:canon:ir1435i_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:ir1435i:-:*:*:*:*:*:*:*

Configuration 66 [-]

AND
cpe:2.3:o:canon:1435if_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:1435if:-:*:*:*:*:*:*:*

Configuration 67 [-]

AND
cpe:2.3:o:canon:1435p_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:1435p:-:*:*:*:*:*:*:*

Configuration 68 [-]

AND
cpe:2.3:o:canon:1435i\+_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:1435i\+:-:*:*:*:*:*:*:*

Configuration 69 [-]

AND
cpe:2.3:o:canon:1435if\+_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:1435if\+:-:*:*:*:*:*:*:*

Configuration 70 [-]

AND
cpe:2.3:o:canon:1435p\+_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:1435p\+:-:*:*:*:*:*:*:*

Configuration 71 [-]

AND
cpe:2.3:o:canon:ir1643i_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:ir1643i:-:*:*:*:*:*:*:*

Configuration 72 [-]

AND
cpe:2.3:o:canon:ir1643if_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:ir1643if:-:*:*:*:*:*:*:*

Configuration 73 [-]

AND
cpe:2.3:o:canon:wg7240_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:wg7240:-:*:*:*:*:*:*:*

Configuration 74 [-]

AND
cpe:2.3:o:canon:wg7250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:wg7250:-:*:*:*:*:*:*:*

Configuration 75 [-]

AND
cpe:2.3:o:canon:wg7250f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:wg7250f:-:*:*:*:*:*:*:*

Configuration 76 [-]

AND
cpe:2.3:o:canon:wg7250z_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:canon:wg7250z:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Canon Subscribe
1435i\+ Subscribe
1435i\+ Firmware Subscribe
1435if Subscribe
1435if\+ Subscribe
1435if\+ Firmware Subscribe
1435if Firmware Subscribe
1435p Subscribe
1435p\+ Subscribe
1435p\+ Firmware Subscribe
1435p Firmware Subscribe
D1520 Subscribe
D1520 Firmware Subscribe
D1550 Subscribe
D1550 Firmware Subscribe
D1620 Subscribe
D1620 Firmware Subscribe
D1650 Subscribe
D1650 Firmware Subscribe
Ir1435i Subscribe
Ir1435i Firmware Subscribe
Ir1643i Subscribe
Ir1643i Firmware Subscribe
Ir1643if Subscribe
Ir1643if Firmware Subscribe
Lbp1127c Subscribe
Lbp1127c Firmware Subscribe
Lbp1238 Subscribe
Lbp1238 Firmware Subscribe
Lbp1238 Ii Subscribe
Lbp1238 Ii Firmware Subscribe
Lbp214dw Subscribe
Lbp214dw Firmware Subscribe
Lbp215dw Subscribe
Lbp215dw Firmware Subscribe
Lbp226dw Subscribe
Lbp226dw Firmware Subscribe
Lbp227dw Subscribe
Lbp227dw Firmware Subscribe
Lbp228dw Subscribe
Lbp228dw Firmware Subscribe
Lbp236dw Subscribe
Lbp236dw Firmware Subscribe
Lbp237dw Subscribe
Lbp237dw Firmware Subscribe
Lbp251dw Subscribe
Lbp251dw Firmware Subscribe
Lbp253dw Subscribe
Lbp253dw Firmware Subscribe
Lbp612cdw Subscribe
Lbp612cdw Firmware Subscribe
Lbp622cdw Subscribe
Lbp622cdw Firmware Subscribe
Lbp623cdw Subscribe
Lbp623cdw Firmware Subscribe
Lbp654cdw Subscribe
Lbp654cdw Firmware Subscribe
Lbp664cdw Subscribe
Lbp664cdw Firmware Subscribe
Mf1127c Subscribe
Mf1127c Firmware Subscribe
Mf1238 Subscribe
Mf1238 Firmware Subscribe
Mf1238 Ii Subscribe
Mf1238 Ii Firmware Subscribe
Mf1643i Ii Subscribe
Mf1643i Ii Firmware Subscribe
Mf1643if Ii Subscribe
Mf1643if Ii Firmware Subscribe
Mf414dw Subscribe
Mf414dw Firmware Subscribe
Mf416dw Subscribe
Mf416dw Firmware Subscribe
Mf419dw Subscribe
Mf419dw Firmware Subscribe
Mf424dw Subscribe
Mf424dw Firmware Subscribe
Mf426dw Subscribe
Mf426dw Firmware Subscribe
Mf429dw Subscribe
Mf429dw Firmware Subscribe
Mf445dw Subscribe
Mf445dw Firmware Subscribe
Mf448dw Subscribe
Mf448dw Firmware Subscribe
Mf449dw Subscribe
Mf449dw Firmware Subscribe
Mf451dw Subscribe
Mf451dw Firmware Subscribe
Mf452dw Subscribe
Mf452dw Firmware Subscribe
Mf453dw Subscribe
Mf453dw Firmware Subscribe
Mf455dw Subscribe
Mf455dw Firmware Subscribe
Mf515dw Subscribe
Mf515dw Firmware Subscribe
Mf525dw Subscribe
Mf525dw Firmware Subscribe
Mf543dw Subscribe
Mf543dw Firmware Subscribe
Mf6160dw Subscribe
Mf6160dw Firmware Subscribe
Mf6180dw Subscribe
Mf6180dw Firmware Subscribe
Mf624cdw Subscribe
Mf624cdw Firmware Subscribe
Mf628cdw Subscribe
Mf628cdw Firmware Subscribe
Mf632cdw Subscribe
Mf632cdw Firmware Subscribe
Mf634cdw Subscribe
Mf634cdw Firmware Subscribe
Mf641cw Subscribe
Mf641cw Firmware Subscribe
Mf642cdw Subscribe
Mf642cdw Firmware Subscribe
Mf644cdw Subscribe
Mf644cdw Firmware Subscribe
Mf726cdw Subscribe
Mf726cdw Firmware Subscribe
Mf729cdw Subscribe
Mf729cdw Firmware Subscribe
Mf731cdw Subscribe
Mf731cdw Firmware Subscribe
Mf733cdw Subscribe
Mf733cdw Firmware Subscribe
Mf735cdw Subscribe
Mf735cdw Firmware Subscribe
Mf741cdw Subscribe
Mf741cdw Firmware Subscribe
Mf743cdw Subscribe
Mf743cdw Firmware Subscribe
Mf745cdw Subscribe
Mf745cdw Firmware Subscribe
Mf746cdw Subscribe
Mf746cdw Firmware Subscribe
Mf810cdn Subscribe
Mf810cdn Firmware Subscribe
Mf820cdn Subscribe
Mf820cdn Firmware Subscribe
Mf8280cw Subscribe
Mf8280cw Firmware Subscribe
Mf8580cdw Subscribe
Mf8580cdw Firmware Subscribe
Wg7240 Subscribe
Wg7240 Firmware Subscribe
Wg7250 Subscribe
Wg7250 Firmware Subscribe
Wg7250f Subscribe
Wg7250f Firmware Subscribe
Wg7250z Subscribe
Wg7250z Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-29544 This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio cve-icon cve-icon
https://www.zerodayinitiative.com/advisories/ZDI-22-514/ cve-icon cve-icon
History

Wed, 19 Feb 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: zdi

Published:

Updated: 2025-02-19T15:41:43.674Z

Reserved: 2022-02-08T00:00:00.000Z

Link: CVE-2022-24672

cve-icon Vulnrichment

Updated: 2024-08-03T04:20:49.127Z

cve-icon NVD

Status : Modified

Published: 2023-03-28T19:15:10.727

Modified: 2024-11-21T06:50:50.187

Link: CVE-2022-24672

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses