Out-of-bounds write in Canon Inc. Satera MF750C Series
Priority MEDIUM 46CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01642 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | Satera MF750C Series | up to 03.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF750C Series | up to 03.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS X MF1333C | up to 03.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF754Cdw | up to 03.07 | — | No fix listed | CNA |
| Canon Inc. | C1333iF | up to 03.07 | — | No fix listed | CNA |
- Satera MF750C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
- Color imageCLASS MF750C Series VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
- Color imageCLASS X MF1333C VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
- i-SENSYS MF754Cdw VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
- C1333iF VendorCanon Inc. Affected up to 03.07 Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:i-sensys_mf754cdw_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf754cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_x_c1333if_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_x_c1333if:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf755cdw_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf755cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf753cdw_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf753cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:mf751cdw_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf751cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:i-sensys_mf754cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf754cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_x_c1333if_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_x_c1333if:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf755cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf755cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf753cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf753cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:mf751cdw_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf751cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:mf1333c_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:mf1333c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:lbp1333c_firmware:*:*:*:*:*:*:*:* | up to 03.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:lbp1333c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:mf1333c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:mf1333c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:lbp1333c_firmware:*:*:*:*:*:*:*:* Versions up to 03.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:lbp1333c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Canon Color imageCLASS MF750C Series, Satera MF750C Series — canon.jp/support/support-info/240205vulnerability-response
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 52
- TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- Advisory ·
Canon Color imageCLASS MF750C Series, Satera MF750C Series — psirt.canon/advisory-information/cp2024-001
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 52
- TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
Show 2 more groups
- Advisory ·
Canon Color imageCLASS MF750C Series, Satera MF750C Series — canon-europe.com/support/product-security-latest-news
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 52
- TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- Advisory ·
Canon Color imageCLASS MF750C Series, Satera MF750C Series — usa.canon.com/support/canon-product-advisories/Service-Noti…
7 records Highest priority Priority MEDIUM 7 MEDIUM
Other records, highest priority first
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 52
- TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
- TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C SeriesPriority MEDIUM 46
Timeline
- 2026-10-02 Threatist record created from CVE-2024-0244
- 2026-10-03 Alias added: GHSA-mfph-26j7-jm24
References
Advisory 4
- https://psirt.canon/advisory-information/cp2024-001/
- https://canon.jp/support/support-info/240205vulnerability-response
- https://www.usa.canon.com/support/canon-product-advisories/Service-Notice-Regarding-Vulnerability-Measure-Against-Buffer-Overflow-for-Laser-Printers-and-Small-Office-Multifunctional-Printers
- https://www.canon-europe.com/support/product-security-latest-news/
More Canon Inc. I-sensys Mf754cdw Firmware vulnerabilities
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2023-05724 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2023-05723 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2023-05722 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2023-05721 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2023-05720 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
Sources
- CVE-2024-0244 · CVE Program
- CVE-2024-0244 · NVD
- FIRST EPSS
- GHSA-mfph-26j7-jm24 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences