A passback vulnerability which relates to production printers and office multifunction printers.
Priority LOW 31CWE-522Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- None · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-522.
Summary
A passback vulnerability which relates to production printers and office multifunction printers.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00653 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Canon Inc. | imageRUNNER ADVANCE Series | all version | — | No fix listed | CNA |
| Canon Inc. | imageRUNNER Series | all version | — | No fix listed | CNA |
| Canon Inc. | imagePRESS V Series | all version | — | No fix listed | CNA |
| Canon Inc. | imagePRESS Series | all version | — | No fix listed | CNA |
| Canon Inc. | imageCLASS Series | all version | — | No fix listed | CNA |
- imageRUNNER ADVANCE Series VendorCanon Inc. Affected all version Fixed in — No fix listed CNA
- imageRUNNER Series VendorCanon Inc. Affected all version Fixed in — No fix listed CNA
- imagePRESS V Series VendorCanon Inc. Affected all version Fixed in — No fix listed CNA
- imagePRESS Series VendorCanon Inc. Affected all version Fixed in — No fix listed CNA
- imageCLASS Series VendorCanon Inc. Affected all version Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Canon imageCLASS Series, imageRUNNER Series — canon.jp/support/support-info/250519vulnerability-response
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-02691 A passback vulnerability which relates to office/small office multifunction printers and laser printers.Priority LOW 29
- Advisory ·
Canon imageCLASS Series, imageRUNNER Series — psirt.canon/advisory-information/cp2025-004
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-02691 A passback vulnerability which relates to office/small office multifunction printers and laser printers.Priority LOW 29
Show 1 more group
- Advisory ·
Canon imageCLASS Series, imageRUNNER Series — usa.canon.com/about-us/to-our-customers/cp2025-004-vulnerab…
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2025-02691 A passback vulnerability which relates to office/small office multifunction printers and laser printers.Priority LOW 29
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3078
- 2026-10-03 Alias added: GHSA-w88m-x3f4-8fp7
- 2026-10-16 EPSS moved to the 50th–90th percentile
References
Advisory 4
- https://psirt.canon/advisory-information/cp2025-004/
- https://canon.jp/support/support-info/250519vulnerability-response
- https://www.usa.canon.com/about-us/to-our-customers/cp2025-004-vulnerability-mitigation-remediation-for-production-printers-office-small-office-multifunction-printers-laser-printers
- https://www.canon-europe.com/support/product-security
More Canon Inc. vulnerabilities
- TI-2006-01145 Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote… CVSS 2.0HIGH 7.5
- TI-2006-01147 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 7.5
- TI-2023-05725 Out-of-bounds write in Canon Inc. Satera LBP670C Series CVSS 3.1CRITICAL 9.8
- TI-2025-01879 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11734 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
- TI-2024-11733 Out-of-bounds write in Canon Inc. Satera MF656Cdw CVSS 3.1CRITICAL 9.8
Sources
- CVE-2025-3078 · CVE Program
- CVE-2025-3078 · NVD
- FIRST EPSS
- GHSA-w88m-x3f4-8fp7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences