CVE-2022-24673 - Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.06675.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Canon Subscribe	1435i\+ Subscribe 1435i\+ Firmware Subscribe 1435if Subscribe 1435if\+ Subscribe 1435if\+ Firmware Subscribe 1435if Firmware Subscribe 1435p Subscribe 1435p\+ Subscribe 1435p\+ Firmware Subscribe 1435p Firmware Subscribe D1520 Subscribe D1520 Firmware Subscribe D1550 Subscribe D1550 Firmware Subscribe D1620 Subscribe D1620 Firmware Subscribe D1650 Subscribe D1650 Firmware Subscribe Ir1435i Subscribe Ir1435i Firmware Subscribe Ir1643i Subscribe Ir1643i Firmware Subscribe Ir1643if Subscribe Ir1643if Firmware Subscribe Lbp1127c Subscribe Lbp1127c Firmware Subscribe Lbp1238 Subscribe Lbp1238 Firmware Subscribe Lbp1238 Ii Subscribe Lbp1238 Ii Firmware Subscribe Lbp214dw Subscribe Lbp214dw Firmware Subscribe Lbp215dw Subscribe Lbp215dw Firmware Subscribe Lbp226dw Subscribe Lbp226dw Firmware Subscribe Lbp227dw Subscribe Lbp227dw Firmware Subscribe Lbp228dw Subscribe Lbp228dw Firmware Subscribe Lbp236dw Subscribe Lbp236dw Firmware Subscribe Lbp237dw Subscribe Lbp237dw Firmware Subscribe Lbp251dw Subscribe Lbp251dw Firmware Subscribe Lbp253dw Subscribe Lbp253dw Firmware Subscribe Lbp612cdw Subscribe Lbp612cdw Firmware Subscribe Lbp622cdw Subscribe Lbp622cdw Firmware Subscribe Lbp623cdw Subscribe Lbp623cdw Firmware Subscribe Lbp654cdw Subscribe Lbp654cdw Firmware Subscribe Lbp664cdw Subscribe Lbp664cdw Firmware Subscribe Mf1127c Subscribe Mf1127c Firmware Subscribe Mf1238 Subscribe Mf1238 Firmware Subscribe Mf1238 Ii Subscribe Mf1238 Ii Firmware Subscribe Mf1643i Ii Subscribe Mf1643i Ii Firmware Subscribe Mf1643if Ii Subscribe Mf1643if Ii Firmware Subscribe Mf414dw Subscribe Mf414dw Firmware Subscribe Mf416dw Subscribe Mf416dw Firmware Subscribe Mf419dw Subscribe Mf419dw Firmware Subscribe Mf424dw Subscribe Mf424dw Firmware Subscribe Mf426dw Subscribe Mf426dw Firmware Subscribe Mf429dw Subscribe Mf429dw Firmware Subscribe Mf445dw Subscribe Mf445dw Firmware Subscribe Mf448dw Subscribe Mf448dw Firmware Subscribe Mf449dw Subscribe Mf449dw Firmware Subscribe Mf451dw Subscribe Mf451dw Firmware Subscribe Mf452dw Subscribe Mf452dw Firmware Subscribe Mf453dw Subscribe Mf453dw Firmware Subscribe Mf455dw Subscribe Mf455dw Firmware Subscribe Mf515dw Subscribe Mf515dw Firmware Subscribe Mf525dw Subscribe Mf525dw Firmware Subscribe Mf543dw Subscribe Mf543dw Firmware Subscribe Mf6160dw Subscribe Mf6160dw Firmware Subscribe Mf6180dw Subscribe Mf6180dw Firmware Subscribe Mf624cdw Subscribe Mf624cdw Firmware Subscribe Mf628cdw Subscribe Mf628cdw Firmware Subscribe Mf632cdw Subscribe Mf632cdw Firmware Subscribe Mf634cdw Subscribe Mf634cdw Firmware Subscribe Mf641cw Subscribe Mf641cw Firmware Subscribe Mf642cdw Subscribe Mf642cdw Firmware Subscribe Mf644cdw Subscribe Mf644cdw Firmware Subscribe Mf726cdw Subscribe Mf726cdw Firmware Subscribe Mf729cdw Subscribe Mf729cdw Firmware Subscribe Mf731cdw Subscribe Mf731cdw Firmware Subscribe Mf733cdw Subscribe Mf733cdw Firmware Subscribe Mf735cdw Subscribe Mf735cdw Firmware Subscribe Mf741cdw Subscribe Mf741cdw Firmware Subscribe Mf743cdw Subscribe Mf743cdw Firmware Subscribe Mf745cdw Subscribe Mf745cdw Firmware Subscribe Mf746cdw Subscribe Mf746cdw Firmware Subscribe Mf810cdn Subscribe Mf810cdn Firmware Subscribe Mf820cdn Subscribe Mf820cdn Firmware Subscribe Mf8280cw Subscribe Mf8280cw Firmware Subscribe Mf8580cdw Subscribe Mf8580cdw Firmware Subscribe Wg7240 Subscribe Wg7240 Firmware Subscribe Wg7250 Subscribe Wg7250 Firmware Subscribe Wg7250f Subscribe Wg7250f Firmware Subscribe Wg7250z Subscribe Wg7250z Firmware Subscribe

Configuration 1 [-]

AND

cpe:2.3:o:canon:d1620_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:d1620:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:canon:d1650_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:d1650:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:canon:d1520_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:d1520:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:canon:d1550_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:d1550:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:canon:mf1127c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf1127c:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

cpe:2.3:o:canon:mf1238_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf1238:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

cpe:2.3:o:canon:mf1238_ii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

cpe:2.3:o:canon:mf1643i_ii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

cpe:2.3:o:canon:mf1643if_ii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

cpe:2.3:o:canon:mf414dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf414dw:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

cpe:2.3:o:canon:mf416dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf416dw:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

cpe:2.3:o:canon:mf419dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf419dw:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

cpe:2.3:o:canon:mf515dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf515dw:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

cpe:2.3:o:canon:mf424dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf424dw:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

cpe:2.3:o:canon:mf426dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf426dw:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

cpe:2.3:o:canon:mf429dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf429dw:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

cpe:2.3:o:canon:mf525dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf525dw:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

cpe:2.3:o:canon:mf445dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf445dw:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

cpe:2.3:o:canon:mf448dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf448dw:-:*:*:*:*:*:*:*

Configuration 20 [-]

AND

cpe:2.3:o:canon:mf449dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf449dw:-:*:*:*:*:*:*:*

Configuration 21 [-]

AND

cpe:2.3:o:canon:mf543dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf543dw:-:*:*:*:*:*:*:*

Configuration 22 [-]

AND

cpe:2.3:o:canon:mf451dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:*

Configuration 23 [-]

AND

cpe:2.3:o:canon:mf452dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:*

Configuration 24 [-]

AND

cpe:2.3:o:canon:mf453dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:*

Configuration 25 [-]

AND

cpe:2.3:o:canon:mf455dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*

Configuration 26 [-]

AND

cpe:2.3:o:canon:mf6160dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf6160dw:-:*:*:*:*:*:*:*

Configuration 27 [-]

AND

cpe:2.3:o:canon:mf6180dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf6180dw:-:*:*:*:*:*:*:*

Configuration 28 [-]

AND

cpe:2.3:o:canon:mf624cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf624cdw:-:*:*:*:*:*:*:*

Configuration 29 [-]

AND

cpe:2.3:o:canon:mf628cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf628cdw:-:*:*:*:*:*:*:*

Configuration 30 [-]

AND

cpe:2.3:o:canon:mf632cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf632cdw:-:*:*:*:*:*:*:*

Configuration 31 [-]

AND

cpe:2.3:o:canon:mf634cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf634cdw:-:*:*:*:*:*:*:*

Configuration 32 [-]

AND

cpe:2.3:o:canon:mf641cw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf641cw:-:*:*:*:*:*:*:*

Configuration 33 [-]

AND

cpe:2.3:o:canon:mf642cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf642cdw:-:*:*:*:*:*:*:*

Configuration 34 [-]

AND

cpe:2.3:o:canon:mf644cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf644cdw:-:*:*:*:*:*:*:*

Configuration 35 [-]

AND

cpe:2.3:o:canon:mf726cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf726cdw:-:*:*:*:*:*:*:*

Configuration 36 [-]

AND

cpe:2.3:o:canon:mf729cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf729cdw:-:*:*:*:*:*:*:*

Configuration 37 [-]

AND

cpe:2.3:o:canon:mf731cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf731cdw:-:*:*:*:*:*:*:*

Configuration 38 [-]

AND

cpe:2.3:o:canon:mf733cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf733cdw:-:*:*:*:*:*:*:*

Configuration 39 [-]

AND

cpe:2.3:o:canon:mf735cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf735cdw:-:*:*:*:*:*:*:*

Configuration 40 [-]

AND

cpe:2.3:o:canon:mf741cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf741cdw:-:*:*:*:*:*:*:*

Configuration 41 [-]

AND

cpe:2.3:o:canon:mf743cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf743cdw:-:*:*:*:*:*:*:*

Configuration 42 [-]

AND

cpe:2.3:o:canon:mf745cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf745cdw:-:*:*:*:*:*:*:*

Configuration 43 [-]

AND

cpe:2.3:o:canon:mf746cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf746cdw:-:*:*:*:*:*:*:*

Configuration 44 [-]

AND

cpe:2.3:o:canon:mf810cdn_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf810cdn:-:*:*:*:*:*:*:*

Configuration 45 [-]

AND

cpe:2.3:o:canon:mf820cdn_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf820cdn:-:*:*:*:*:*:*:*

Configuration 46 [-]

AND

cpe:2.3:o:canon:mf8280cw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf8280cw:-:*:*:*:*:*:*:*

Configuration 47 [-]

AND

cpe:2.3:o:canon:mf8580cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:mf8580cdw:-:*:*:*:*:*:*:*

Configuration 48 [-]

AND

cpe:2.3:o:canon:lbp1127c_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp1127c:-:*:*:*:*:*:*:*

Configuration 49 [-]

AND

cpe:2.3:o:canon:lbp1238_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp1238:-:*:*:*:*:*:*:*

Configuration 50 [-]

AND

cpe:2.3:o:canon:lbp1238_ii_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:*

Configuration 51 [-]

AND

cpe:2.3:o:canon:lbp214dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp214dw:-:*:*:*:*:*:*:*

Configuration 52 [-]

AND

cpe:2.3:o:canon:lbp215dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp215dw:-:*:*:*:*:*:*:*

Configuration 53 [-]

AND

cpe:2.3:o:canon:lbp226dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp226dw:-:*:*:*:*:*:*:*

Configuration 54 [-]

AND

cpe:2.3:o:canon:lbp227dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp227dw:-:*:*:*:*:*:*:*

Configuration 55 [-]

AND

cpe:2.3:o:canon:lbp228dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp228dw:-:*:*:*:*:*:*:*

Configuration 56 [-]

AND

cpe:2.3:o:canon:lbp236dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:*

Configuration 57 [-]

AND

cpe:2.3:o:canon:lbp237dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:*

Configuration 58 [-]

AND

cpe:2.3:o:canon:lbp251dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp251dw:-:*:*:*:*:*:*:*

Configuration 59 [-]

AND

cpe:2.3:o:canon:lbp253dw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp253dw:-:*:*:*:*:*:*:*

Configuration 60 [-]

AND

cpe:2.3:o:canon:lbp612cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp612cdw:-:*:*:*:*:*:*:*

Configuration 61 [-]

AND

cpe:2.3:o:canon:lbp622cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp622cdw:-:*:*:*:*:*:*:*

Configuration 62 [-]

AND

cpe:2.3:o:canon:lbp623cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp623cdw:-:*:*:*:*:*:*:*

Configuration 63 [-]

AND

cpe:2.3:o:canon:lbp654cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp654cdw:-:*:*:*:*:*:*:*

Configuration 64 [-]

AND

cpe:2.3:o:canon:lbp664cdw_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:lbp664cdw:-:*:*:*:*:*:*:*

Configuration 65 [-]

AND

cpe:2.3:o:canon:ir1435i_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:ir1435i:-:*:*:*:*:*:*:*

Configuration 66 [-]

AND

cpe:2.3:o:canon:1435if_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:1435if:-:*:*:*:*:*:*:*

Configuration 67 [-]

AND

cpe:2.3:o:canon:1435p_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:1435p:-:*:*:*:*:*:*:*

Configuration 68 [-]

AND

cpe:2.3:o:canon:1435i\+_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:1435i\+:-:*:*:*:*:*:*:*

Configuration 69 [-]

AND

cpe:2.3:o:canon:1435if\+_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:1435if\+:-:*:*:*:*:*:*:*

Configuration 70 [-]

AND

cpe:2.3:o:canon:1435p\+_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:1435p\+:-:*:*:*:*:*:*:*

Configuration 71 [-]

AND

cpe:2.3:o:canon:ir1643i_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:ir1643i:-:*:*:*:*:*:*:*

Configuration 72 [-]

AND

cpe:2.3:o:canon:ir1643if_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:ir1643if:-:*:*:*:*:*:*:*

Configuration 73 [-]

AND

cpe:2.3:o:canon:wg7240_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:wg7240:-:*:*:*:*:*:*:*

Configuration 74 [-]

AND

cpe:2.3:o:canon:wg7250_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:wg7250:-:*:*:*:*:*:*:*

Configuration 75 [-]

AND

cpe:2.3:o:canon:wg7250f_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:wg7250f:-:*:*:*:*:*:*:*

Configuration 76 [-]

AND

cpe:2.3:o:canon:wg7250z_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:canon:wg7250z:-:*:*:*:*:*:*:*

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2022-29545	This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow
https://www.zerodayinitiative.com/advisories/ZDI-22-515/

History

Wed, 19 Feb 2025 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: zdi

Published: 2023-03-28T00:00:00.000Z

Updated: 2025-02-19T15:39:58.261Z

Reserved: 2022-02-08T00:00:00.000Z

Link: CVE-2022-24673

Vulnrichment

Updated: 2024-08-03T04:20:49.148Z

NVD

Status : Modified

Published: 2023-03-28T19:15:10.793

Modified: 2024-11-21T06:50:50.387

Link: CVE-2022-24673

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Projects

JSON object

JSON object

JSON object

JSON object

JSON object