Out-of-bounds write in Canon Inc. Satera MF656Cdw
Priority MEDIUM 51CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.
Summary
Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00915 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | Satera MF656Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Satera MF654Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Satera MF551dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Satera MF457dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF656Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF654Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF653Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS MF652Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS LBP633Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | Color imageCLASS LBP632Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS MF455dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS MF453dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS MF452dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS MF451dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS LBP237dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS LBP236dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1238 II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1643i II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X MF1643iF II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageCLASS X LBP1238 II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF657Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF655Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF651Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP633Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP631Cdw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF553dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF552dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF455dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS MF453dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP236dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS LBP233dw | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageRUNNER 1643iF II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | imageRUNNER 1643i II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS X 1238iF II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS X 1238i II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS X 1238P II | up to 05.07 | — | No fix listed | CNA |
| Canon Inc. | i-SENSYS X 1238Pr II | up to 05.07 | — | No fix listed | CNA |
- Satera MF656Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Satera MF654Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Satera MF551dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Satera MF457dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS MF656Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS MF654Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS MF653Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS MF652Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS LBP633Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- Color imageCLASS LBP632Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS MF455dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS MF453dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS MF452dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS MF451dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS LBP237dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS LBP236dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS X MF1238 II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS X MF1643i II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS X MF1643iF II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageCLASS X LBP1238 II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF657Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF655Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF651Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS LBP633Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS LBP631Cdw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF553dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF552dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF455dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS MF453dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS LBP236dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS LBP233dw VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageRUNNER 1643iF II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- imageRUNNER 1643i II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS X 1238iF II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS X 1238i II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS X 1238P II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
- i-SENSYS X 1238Pr II VendorCanon Inc. Affected up to 05.07 Fixed in — No fix listed CNA
CPE configurations NVD · 74
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:satera_mf656cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:satera_mf656cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:satera_mf654cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:satera_mf654cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:satera_mf551dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:satera_mf551dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:satera_mf457dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:satera_mf457dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf656cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf656cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:satera_mf656cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:satera_mf656cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:satera_mf654cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:satera_mf654cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:satera_mf551dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:satera_mf551dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:satera_mf457dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:satera_mf457dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf656cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf656cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Show 64 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canon:imageclass_mf654cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf654cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf653cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf653cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf652cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf652cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_lbp633cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_lbp633cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_lbp632cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_lbp632cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf455dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf455dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf453dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf453dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf452dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf452dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_mf451dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_mf451dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_lbp237dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_lbp237dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_lbp236dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_lbp236dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_x_mf1238_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_x_mf1238_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_x_mf1643i_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_x_mf1643i_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_x_mf1643if_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_x_mf1643if_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imageclass_x_lbp1238_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imageclass_x_lbp1238_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf657cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf657cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf655cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf655cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf651cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf651cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_lbp633cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_lbp633cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_lbp631cdw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_lbp631cdw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf553dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf553dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf552dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf552dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf455dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf455dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_mf453dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_mf453dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_lbp236dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_lbp236dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_lbp233dw_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_lbp233dw:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imagerunner_1643if_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imagerunner_1643if_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:imagerunner_1643i_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:imagerunner_1643i_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_x_1238if_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_x_1238if_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_x_1238i_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_x_1238i_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_x_1238p_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_x_1238p_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
| cpe:2.3:o:canon:i-sensys_x_1238pr_ii_firmware:*:*:*:*:*:*:*:* | up to 05.07 | Vulnerable | Canon Inc. |
| cpe:2.3:h:canon:i-sensys_x_1238pr_ii:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Canon Inc. |
- cpe:2.3:o:canon:imageclass_mf654cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf654cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf653cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf653cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf652cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf652cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_lbp633cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_lbp633cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_lbp632cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_lbp632cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf455dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf455dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf453dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf453dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf452dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf452dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_mf451dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_mf451dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_lbp237dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_lbp237dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_lbp236dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_lbp236dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_x_mf1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_x_mf1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_x_mf1643i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_x_mf1643i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_x_mf1643if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_x_mf1643if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imageclass_x_lbp1238_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imageclass_x_lbp1238_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf657cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf657cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf655cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf655cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf651cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf651cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_lbp633cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_lbp633cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_lbp631cdw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_lbp631cdw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf553dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf553dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf552dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf552dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf455dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf455dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_mf453dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_mf453dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_lbp236dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_lbp236dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_lbp233dw_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_lbp233dw:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imagerunner_1643if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imagerunner_1643if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:imagerunner_1643i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:imagerunner_1643i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_x_1238if_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_x_1238if_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_x_1238i_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_x_1238i_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_x_1238p_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_x_1238p_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
- cpe:2.3:o:canon:i-sensys_x_1238pr_ii_firmware:*:*:*:*:*:*:*:* Versions up to 05.07 Vulnerable ·Canon Inc.
- cpe:2.3:h:canon:i-sensys_x_1238pr_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Canon Inc.
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-2146
- 2026-10-03 Alias added: GHSA-xcjx-g6h3-96jc
References
Advisory 4
- https://psirt.canon/advisory-information/cp2025-001/
- https://canon.jp/support/support-info/250127vulnerability-response
- https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers
- https://www.canon-europe.com/support/product-security/#news
Sources
- CVE-2025-2146 · CVE Program
- CVE-2025-2146 · NVD
- FIRST EPSS
- GHSA-xcjx-g6h3-96jc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences