CVE-2022-24672
Canon imageCLASS MF644Cdw CADM Heap-based Buffer Overflow Remote Code Execution Vulnerability
Severity Score
8.8
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw printers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account.
*Credits:
Mehdi Talbi (@abu_y0ussef), Remi Jullian (@netsecurity1), Thomas Jeunet (@cleptho), from @Synacktiv
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2022-02-08 CVE Reserved
- 2023-03-01 CVE Published
- 2024-08-03 CVE Updated
- 2024-09-07 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-122: Heap-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-22-514 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Canon Search vendor "Canon" | D1620 Firmware Search vendor "Canon" for product "D1620 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | D1620 Search vendor "Canon" for product "D1620" | - | - |
Safe
|
| Canon Search vendor "Canon" | D1650 Firmware Search vendor "Canon" for product "D1650 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | D1650 Search vendor "Canon" for product "D1650" | - | - |
Safe
|
| Canon Search vendor "Canon" | D1520 Firmware Search vendor "Canon" for product "D1520 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | D1520 Search vendor "Canon" for product "D1520" | - | - |
Safe
|
| Canon Search vendor "Canon" | D1550 Firmware Search vendor "Canon" for product "D1550 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | D1550 Search vendor "Canon" for product "D1550" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf1127c Firmware Search vendor "Canon" for product "Mf1127c Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf1127c Search vendor "Canon" for product "Mf1127c" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf1238 Firmware Search vendor "Canon" for product "Mf1238 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf1238 Search vendor "Canon" for product "Mf1238" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf1238 Ii Firmware Search vendor "Canon" for product "Mf1238 Ii Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf1238 Ii Search vendor "Canon" for product "Mf1238 Ii" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf1643i Ii Firmware Search vendor "Canon" for product "Mf1643i Ii Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf1643i Ii Search vendor "Canon" for product "Mf1643i Ii" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf1643if Ii Firmware Search vendor "Canon" for product "Mf1643if Ii Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf1643if Ii Search vendor "Canon" for product "Mf1643if Ii" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf414dw Firmware Search vendor "Canon" for product "Mf414dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf414dw Search vendor "Canon" for product "Mf414dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf416dw Firmware Search vendor "Canon" for product "Mf416dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf416dw Search vendor "Canon" for product "Mf416dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf419dw Firmware Search vendor "Canon" for product "Mf419dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf419dw Search vendor "Canon" for product "Mf419dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf515dw Firmware Search vendor "Canon" for product "Mf515dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf515dw Search vendor "Canon" for product "Mf515dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf424dw Firmware Search vendor "Canon" for product "Mf424dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf424dw Search vendor "Canon" for product "Mf424dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf426dw Firmware Search vendor "Canon" for product "Mf426dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf426dw Search vendor "Canon" for product "Mf426dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf429dw Firmware Search vendor "Canon" for product "Mf429dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf429dw Search vendor "Canon" for product "Mf429dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf525dw Firmware Search vendor "Canon" for product "Mf525dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf525dw Search vendor "Canon" for product "Mf525dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf445dw Firmware Search vendor "Canon" for product "Mf445dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf445dw Search vendor "Canon" for product "Mf445dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf448dw Firmware Search vendor "Canon" for product "Mf448dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf448dw Search vendor "Canon" for product "Mf448dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf449dw Firmware Search vendor "Canon" for product "Mf449dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf449dw Search vendor "Canon" for product "Mf449dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf543dw Firmware Search vendor "Canon" for product "Mf543dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf543dw Search vendor "Canon" for product "Mf543dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf451dw Firmware Search vendor "Canon" for product "Mf451dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf451dw Search vendor "Canon" for product "Mf451dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf452dw Firmware Search vendor "Canon" for product "Mf452dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf452dw Search vendor "Canon" for product "Mf452dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf453dw Firmware Search vendor "Canon" for product "Mf453dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf453dw Search vendor "Canon" for product "Mf453dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf455dw Firmware Search vendor "Canon" for product "Mf455dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf455dw Search vendor "Canon" for product "Mf455dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf6160dw Firmware Search vendor "Canon" for product "Mf6160dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf6160dw Search vendor "Canon" for product "Mf6160dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf6180dw Firmware Search vendor "Canon" for product "Mf6180dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf6180dw Search vendor "Canon" for product "Mf6180dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf624cdw Firmware Search vendor "Canon" for product "Mf624cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf624cdw Search vendor "Canon" for product "Mf624cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf628cdw Firmware Search vendor "Canon" for product "Mf628cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf628cdw Search vendor "Canon" for product "Mf628cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf632cdw Firmware Search vendor "Canon" for product "Mf632cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf632cdw Search vendor "Canon" for product "Mf632cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf634cdw Firmware Search vendor "Canon" for product "Mf634cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf634cdw Search vendor "Canon" for product "Mf634cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf641cw Firmware Search vendor "Canon" for product "Mf641cw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf641cw Search vendor "Canon" for product "Mf641cw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf642cdw Firmware Search vendor "Canon" for product "Mf642cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf642cdw Search vendor "Canon" for product "Mf642cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf644cdw Firmware Search vendor "Canon" for product "Mf644cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf644cdw Search vendor "Canon" for product "Mf644cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf726cdw Firmware Search vendor "Canon" for product "Mf726cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf726cdw Search vendor "Canon" for product "Mf726cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf729cdw Firmware Search vendor "Canon" for product "Mf729cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf729cdw Search vendor "Canon" for product "Mf729cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf731cdw Firmware Search vendor "Canon" for product "Mf731cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf731cdw Search vendor "Canon" for product "Mf731cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf733cdw Firmware Search vendor "Canon" for product "Mf733cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf733cdw Search vendor "Canon" for product "Mf733cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf735cdw Firmware Search vendor "Canon" for product "Mf735cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf735cdw Search vendor "Canon" for product "Mf735cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf741cdw Firmware Search vendor "Canon" for product "Mf741cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf741cdw Search vendor "Canon" for product "Mf741cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf743cdw Firmware Search vendor "Canon" for product "Mf743cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf743cdw Search vendor "Canon" for product "Mf743cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf745cdw Firmware Search vendor "Canon" for product "Mf745cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf745cdw Search vendor "Canon" for product "Mf745cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf746cdw Firmware Search vendor "Canon" for product "Mf746cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf746cdw Search vendor "Canon" for product "Mf746cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf810cdn Firmware Search vendor "Canon" for product "Mf810cdn Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf810cdn Search vendor "Canon" for product "Mf810cdn" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf820cdn Firmware Search vendor "Canon" for product "Mf820cdn Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf820cdn Search vendor "Canon" for product "Mf820cdn" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf8280cw Firmware Search vendor "Canon" for product "Mf8280cw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf8280cw Search vendor "Canon" for product "Mf8280cw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Mf8580cdw Firmware Search vendor "Canon" for product "Mf8580cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Mf8580cdw Search vendor "Canon" for product "Mf8580cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp1127c Firmware Search vendor "Canon" for product "Lbp1127c Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp1127c Search vendor "Canon" for product "Lbp1127c" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp1238 Firmware Search vendor "Canon" for product "Lbp1238 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp1238 Search vendor "Canon" for product "Lbp1238" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp1238 Ii Firmware Search vendor "Canon" for product "Lbp1238 Ii Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp1238 Ii Search vendor "Canon" for product "Lbp1238 Ii" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp214dw Firmware Search vendor "Canon" for product "Lbp214dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp214dw Search vendor "Canon" for product "Lbp214dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp215dw Firmware Search vendor "Canon" for product "Lbp215dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp215dw Search vendor "Canon" for product "Lbp215dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp226dw Firmware Search vendor "Canon" for product "Lbp226dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp226dw Search vendor "Canon" for product "Lbp226dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp227dw Firmware Search vendor "Canon" for product "Lbp227dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp227dw Search vendor "Canon" for product "Lbp227dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp228dw Firmware Search vendor "Canon" for product "Lbp228dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp228dw Search vendor "Canon" for product "Lbp228dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp236dw Firmware Search vendor "Canon" for product "Lbp236dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp236dw Search vendor "Canon" for product "Lbp236dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp237dw Firmware Search vendor "Canon" for product "Lbp237dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp237dw Search vendor "Canon" for product "Lbp237dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp251dw Firmware Search vendor "Canon" for product "Lbp251dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp251dw Search vendor "Canon" for product "Lbp251dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp253dw Firmware Search vendor "Canon" for product "Lbp253dw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp253dw Search vendor "Canon" for product "Lbp253dw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp612cdw Firmware Search vendor "Canon" for product "Lbp612cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp612cdw Search vendor "Canon" for product "Lbp612cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp622cdw Firmware Search vendor "Canon" for product "Lbp622cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp622cdw Search vendor "Canon" for product "Lbp622cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp623cdw Firmware Search vendor "Canon" for product "Lbp623cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp623cdw Search vendor "Canon" for product "Lbp623cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp654cdw Firmware Search vendor "Canon" for product "Lbp654cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp654cdw Search vendor "Canon" for product "Lbp654cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Lbp664cdw Firmware Search vendor "Canon" for product "Lbp664cdw Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Lbp664cdw Search vendor "Canon" for product "Lbp664cdw" | - | - |
Safe
|
| Canon Search vendor "Canon" | Ir1435i Firmware Search vendor "Canon" for product "Ir1435i Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Ir1435i Search vendor "Canon" for product "Ir1435i" | - | - |
Safe
|
| Canon Search vendor "Canon" | 1435if Firmware Search vendor "Canon" for product "1435if Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | 1435if Search vendor "Canon" for product "1435if" | - | - |
Safe
|
| Canon Search vendor "Canon" | 1435p Firmware Search vendor "Canon" for product "1435p Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | 1435p Search vendor "Canon" for product "1435p" | - | - |
Safe
|
| Canon Search vendor "Canon" | 1435i\+ Firmware Search vendor "Canon" for product "1435i\+ Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | 1435i\+ Search vendor "Canon" for product "1435i\+" | - | - |
Safe
|
| Canon Search vendor "Canon" | 1435if\+ Firmware Search vendor "Canon" for product "1435if\+ Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | 1435if\+ Search vendor "Canon" for product "1435if\+" | - | - |
Safe
|
| Canon Search vendor "Canon" | 1435p\+ Firmware Search vendor "Canon" for product "1435p\+ Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | 1435p\+ Search vendor "Canon" for product "1435p\+" | - | - |
Safe
|
| Canon Search vendor "Canon" | Ir1643i Firmware Search vendor "Canon" for product "Ir1643i Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Ir1643i Search vendor "Canon" for product "Ir1643i" | - | - |
Safe
|
| Canon Search vendor "Canon" | Ir1643if Firmware Search vendor "Canon" for product "Ir1643if Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Ir1643if Search vendor "Canon" for product "Ir1643if" | - | - |
Safe
|
| Canon Search vendor "Canon" | Wg7240 Firmware Search vendor "Canon" for product "Wg7240 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Wg7240 Search vendor "Canon" for product "Wg7240" | - | - |
Safe
|
| Canon Search vendor "Canon" | Wg7250 Firmware Search vendor "Canon" for product "Wg7250 Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Wg7250 Search vendor "Canon" for product "Wg7250" | - | - |
Safe
|
| Canon Search vendor "Canon" | Wg7250f Firmware Search vendor "Canon" for product "Wg7250f Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Wg7250f Search vendor "Canon" for product "Wg7250f" | - | - |
Safe
|
| Canon Search vendor "Canon" | Wg7250z Firmware Search vendor "Canon" for product "Wg7250z Firmware" | - | - |
Affected
| in | Canon Search vendor "Canon" | Wg7250z Search vendor "Canon" for product "Wg7250z" | - | - |
Safe
|