Read the docs
TI-2023-05725 Aliases CVE-2023-6234GHSA-8xpr-jq7w-573j

Out-of-bounds write in Canon Inc. Satera LBP670C Series

Priority MEDIUM 52CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01383 72nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canon Inc.Satera LBP670C Seriesup to 03.07—No fix listedCNA
Canon Inc.Satera MF750C Seriesup to 03.07—No fix listedCNA
Canon Inc.Color imageCLASS LBP674Cup to 03.07—No fix listedCNA
Canon Inc.Color imageCLASS X LBP1333Cup to 03.07—No fix listedCNA
Canon Inc.Color imageCLASS MF750C Seriesup to 03.07—No fix listedCNA
Canon Inc.Color imageCLASS X MF1333C Seriesup to 03.07—No fix listedCNA
Canon Inc.i-SENSYS LBP673Cdwup to 03.07—No fix listedCNA
Canon Inc.C1333Pup to 03.07—No fix listedCNA
Canon Inc.i-SENSYS MF750C Seriesup to 03.07—No fix listedCNA
Canon Inc.C1333i Seriesup to 03.07—No fix listedCNA
  • Satera LBP670C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • Satera MF750C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • Color imageCLASS LBP674C VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • Color imageCLASS X LBP1333C VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • Color imageCLASS MF750C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • Color imageCLASS X MF1333C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • i-SENSYS LBP673Cdw VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • C1333P VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • i-SENSYS MF750C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
  • C1333i Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA

CPE configurations NVD · 58

CPEVersionsRoleVendor
cpe:2.3:o:canon:mf755cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf755cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf753cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf753cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf751cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf751cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp674c_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp674c:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp672c_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp672c:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
  • cpe:2.3:o:canon:mf755cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf755cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf753cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf753cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf751cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf751cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp674c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp674c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp672c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp672c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Show 48 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canon:lbp671c_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp671c:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1333c_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf1333c:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf275dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf275dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf273dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf273dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf272dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf272dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp122dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp122dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp1333c_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp1333c:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp674cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:lbp674cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_mf754cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_mf754cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_x_c1333if_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_x_c1333if:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_lbp673cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_lbp673cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_mf752cdw_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_mf752cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_x_c1333i_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_x_c1333i:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:i-sensys_x_c1333p_firmware:*:*:*:*:*:*:*:*up to 03.07VulnerableCanon Inc.
cpe:2.3:h:canon:i-sensys_x_c1333p:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
  • cpe:2.3:o:canon:lbp671c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp671c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1333c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1333c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf275dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf275dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf273dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf273dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf272dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf272dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp122dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp122dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp1333c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp1333c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp674cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp674cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_mf754cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_mf754cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_x_c1333if_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_x_c1333if:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_lbp673cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_lbp673cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_mf752cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_mf752cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_x_c1333i_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_x_c1333i:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:i-sensys_x_c1333p_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:i-sensys_x_c1333p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Canon C1333P, C1333i Series and 8 more products — canon.jp/support/support-info/240205vulnerability-response

    7 records Highest priority Priority MEDIUM 7 MEDIUM

    Other records, highest priority first

    • TI-2024-00219 Out-of-bounds write in Canon Inc. Satera MF750C SeriesPriority MEDIUM 46
    • TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
    • TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
  • Advisory ·

    Canon C1333P, C1333i Series and 8 more products — psirt.canon/advisory-information/cp2024-001

    7 records Highest priority Priority MEDIUM 7 MEDIUM

    Other records, highest priority first

    • TI-2024-00219 Out-of-bounds write in Canon Inc. Satera MF750C SeriesPriority MEDIUM 46
    • TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
    • TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
Show 2 more groups
  • Advisory ·

    Canon C1333P, C1333i Series and 8 more products — canon-europe.com/support/product-security-latest-news

    7 records Highest priority Priority MEDIUM 7 MEDIUM

    Other records, highest priority first

    • TI-2024-00219 Out-of-bounds write in Canon Inc. Satera MF750C SeriesPriority MEDIUM 46
    • TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
    • TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
  • Advisory ·

    Canon C1333P, C1333i Series and 8 more products — usa.canon.com/support/canon-product-advisories/Service-Noti…

    7 records Highest priority Priority MEDIUM 7 MEDIUM

    Other records, highest priority first

    • TI-2024-00219 Out-of-bounds write in Canon Inc. Satera MF750C SeriesPriority MEDIUM 46
    • TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
    • TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6234
  2. 2026-10-03 Alias added: GHSA-8xpr-jq7w-573j

References

  • TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2023-05722 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2023-05721 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2023-05720 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8

Sources