Read the docs
TI-2024-11733 Aliases CVE-2024-12648GHSA-9cwq-g8xg-jgrg

Out-of-bounds write in Canon Inc. Satera MF656Cdw

Priority MEDIUM 51CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01169 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canon Inc.Satera MF656Cdwup to 05.04—No fix listedCNA
Canon Inc.Satera MF654Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS MF656Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS MF654Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS MF653Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS MF652Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS LBP633Cdwup to 05.04—No fix listedCNA
Canon Inc.Color imageCLASS LBP632Cdwup to 05.04—No fix listedCNA
Canon Inc.i-SENSYS MF657Cdwup to 05.04—No fix listedCNA
Canon Inc.i-SENSYS MF655Cdwup to 05.04—No fix listedCNA
Canon Inc.i-SENSYS MF651Cdwup to 05.04—No fix listedCNA
Canon Inc.i-SENSYS LBP633Cdwup to 05.04—No fix listedCNA
Canon Inc.i-SENSYS LBP631Cdwup to 05.04—No fix listedCNA
  • Satera MF656Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Satera MF654Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS MF656Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS MF654Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS MF653Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS MF652Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS LBP633Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • Color imageCLASS LBP632Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • i-SENSYS MF657Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • i-SENSYS MF655Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • i-SENSYS MF651Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • i-SENSYS LBP633Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA
  • i-SENSYS LBP631Cdw VendorCanon Inc. Affected up to 05.04 Fixed in — No fix listed CNA

CPE configurations NVD · 44

CPEVersionsRoleVendor
cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf465dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf465dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
  • cpe:2.3:o:canon:mf455dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf455dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf453dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf453dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf452dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf452dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf451dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf451dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf465dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf465dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Show 34 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:canon:mf462dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf462dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf656cdw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf656cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf653cdw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf653cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf652cw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf652cw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1440_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf1440:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp247dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp247dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp246dw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp246dw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp633cdw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp633cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp632cdw_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp632cdw:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
cpe:2.3:o:canon:lbp1440_firmware:*:*:*:*:*:*:*:*up to 05.04VulnerableCanon Inc.
cpe:2.3:h:canon:lbp1440:-:*:*:*:*:*:*:*not specified by NVDRunning onCanon Inc.
  • cpe:2.3:o:canon:mf462dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf462dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf656cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf656cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf654cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf654cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf653cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf653cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf652cw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf652cw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1440_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1643if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1643if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:mf1643i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:mf1643i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp237dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp237dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp236dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp236dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp247dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp247dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp246dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp246dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp633cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp633cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp632cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp632cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
  • cpe:2.3:o:canon:lbp1440_firmware:*:*:*:*:*:*:*:* Versions up to 05.04 Vulnerable ·Canon Inc.
  • cpe:2.3:h:canon:lbp1440:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Canon Color imageCLASS LBP632Cdw, Color imageCLASS LBP633Cdw and 11 more products — canon.jp/support/support-info/250127vulnerability-response

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    • TI-2024-11732 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    Show all 3 records → Advisory →
  • Advisory ·

    Canon Color imageCLASS LBP632Cdw, Color imageCLASS LBP633Cdw and 11 more products — psirt.canon/advisory-information/cp2025-001

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    • TI-2024-11732 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    Show all 3 records → Advisory →
Show 1 more group
  • Advisory ·

    Canon Color imageCLASS LBP632Cdw, Color imageCLASS LBP633Cdw and 11 more products — usa.canon.com/support/canon-product-advisories/service-noti…

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    • TI-2024-11732 Out-of-bounds write in Canon Inc. Satera MF656CdwPriority MEDIUM 51
    Show all 3 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12648
  2. 2026-10-03 Alias added: GHSA-9cwq-g8xg-jgrg

References

Advisory 4

  • TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
  • TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
  • TI-2024-11732 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
  • TI-2025-13015 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 4.0CRITICAL 9.3
  • TI-2025-13014 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 4.0CRITICAL 9.3
  • TI-2025-13013 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 4.0CRITICAL 9.3
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences