A vulnerability in the browser-based remote management interface enables an attacker to submit crafted requests that reveal sensitive information stored on the device. The weakness is classified as CWE-807, indicating a failure to properly restrict operations within the security context. This flaw allows an authenticated or unauthenticated attacker to gain access to confidential data that should be protected from external inspection.

Canon Inc. production printers and office/small office multifunction printers, including models such as MF842CDW, MF842CX, Satera MF7525F, Satera MF7625F, Satera MF7725F, Satera MF842CDW, i-SENSYS C1533iF II, i-SENSYS MF842Cdw, i-SENSYS X C1538 iF II, imageCLASS X C1538iF II, imageCLASS X MF1538C II, imageFORCE Series, imagePRESS Series, imageRUNNER ADVANCE Series, and imageRUNNER Series. No specific firmware versions are listed as affected.

The vulnerability carries a CVSS score of 6.9, placing it in the moderate severity range. Its EPSS score is less than 1%, indicating that active exploitation is unlikely at present. The issue is not listed in the CISA KEV catalog. The likely attack scenario requires network access to the printer’s remote management interface and may need administrative authentication; an attacker could send malicious requests from within the local network or through a compromised network perimeter. Due to the limited reach and moderate score, the overall risk to the organization is moderate but should be mitigated to prevent potential data leakage.