CVE-2022-24672

Published: Mar 28, 2023Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.

Affected (76)

Products: Canon: D1620 Firmware, D1650 Firmware, D1520 Firmware, D1550 Firmware, Mf1127c Firmware, Mf1238 Firmware, Mf1238 Ii Firmware, Mf1643i Ii Firmware, Mf1643if Ii Firmware, Mf414dw Firmware, Mf416dw Firmware, Mf419dw Firmware, Mf515dw Firmware, Mf424dw Firmware, Mf426dw Firmware, Mf429dw Firmware, Mf525dw Firmware, Mf445dw Firmware, Mf448dw Firmware, Mf449dw Firmware, Mf543dw Firmware, Mf451dw Firmware, Mf452dw Firmware, Mf453dw Firmware, Mf455dw Firmware, Mf6160dw Firmware, Mf6180dw Firmware, Mf624cdw Firmware, Mf628cdw Firmware, Mf632cdw Firmware, Mf634cdw Firmware, Mf641cw Firmware, Mf642cdw Firmware, Mf644cdw Firmware, Mf726cdw Firmware, Mf729cdw Firmware, Mf731cdw Firmware, Mf733cdw Firmware, Mf735cdw Firmware, Mf741cdw Firmware, Mf743cdw Firmware, Mf745cdw Firmware, Mf746cdw Firmware, Mf810cdn Firmware, Mf820cdn Firmware, Mf8280cw Firmware, Mf8580cdw Firmware, Lbp1127c Firmware, Lbp1238 Firmware, Lbp1238 Ii Firmware, Lbp214dw Firmware, Lbp215dw Firmware, Lbp226dw Firmware, Lbp227dw Firmware, Lbp228dw Firmware, Lbp236dw Firmware, Lbp237dw Firmware, Lbp251dw Firmware, Lbp253dw Firmware, Lbp612cdw Firmware, Lbp622cdw Firmware, Lbp623cdw Firmware, Lbp654cdw Firmware, Lbp664cdw Firmware, Ir1435i Firmware, 1435if+ Firmware, 1435p+ Firmware, 1435i+ Firmware, Ir1643i Firmware, Ir1643if Firmware, Wg7240 Firmware, Wg7250 Firmware, Wg7250f Firmware, Wg7250z Firmware

74 products

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon D1620 Firmware	All versions

Running on/with	Platform Versions
Canon D1620	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon D1650 Firmware	All versions

Running on/with	Platform Versions
Canon D1650	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon D1520 Firmware	All versions

Running on/with	Platform Versions
Canon D1520	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon D1550 Firmware	All versions

Running on/with	Platform Versions
Canon D1550	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1127c Firmware	All versions

Running on/with	Platform Versions
Canon Mf1127c	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1238 Firmware	All versions

Running on/with	Platform Versions
Canon Mf1238	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1238 Ii Firmware	All versions

Running on/with	Platform Versions
Canon Mf1238 Ii	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1643i Ii Firmware	All versions

Running on/with	Platform Versions
Canon Mf1643i Ii	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf1643if Ii Firmware	All versions

Running on/with	Platform Versions
Canon Mf1643if Ii	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf414dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf414dw	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf416dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf416dw	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf419dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf419dw	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf515dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf515dw	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf424dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf424dw	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf426dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf426dw	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf429dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf429dw	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf525dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf525dw	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf445dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf445dw	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf448dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf448dw	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf449dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf449dw	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf543dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf543dw	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf451dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf451dw	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf452dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf452dw	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf453dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf453dw	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf455dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf455dw	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf6160dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf6160dw	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf6180dw Firmware	All versions

Running on/with	Platform Versions
Canon Mf6180dw	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf624cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf624cdw	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf628cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf628cdw	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf632cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf632cdw	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf634cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf634cdw	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf641cw Firmware	All versions

Running on/with	Platform Versions
Canon Mf641cw	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf642cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf642cdw	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf644cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf644cdw	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf726cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf726cdw	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf729cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf729cdw	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf731cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf731cdw	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf733cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf733cdw	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf735cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf735cdw	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf741cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf741cdw	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf743cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf743cdw	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf745cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf745cdw	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf746cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf746cdw	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf810cdn Firmware	All versions

Running on/with	Platform Versions
Canon Mf810cdn	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf820cdn Firmware	All versions

Running on/with	Platform Versions
Canon Mf820cdn	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf8280cw Firmware	All versions

Running on/with	Platform Versions
Canon Mf8280cw	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Mf8580cdw Firmware	All versions

Running on/with	Platform Versions
Canon Mf8580cdw	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp1127c Firmware	All versions

Running on/with	Platform Versions
Canon Lbp1127c	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp1238 Firmware	All versions

Running on/with	Platform Versions
Canon Lbp1238	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp1238 Ii Firmware	All versions

Running on/with	Platform Versions
Canon Lbp1238 Ii	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp214dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp214dw	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp215dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp215dw	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp226dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp226dw	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp227dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp227dw	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp228dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp228dw	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp236dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp236dw	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp237dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp237dw	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp251dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp251dw	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp253dw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp253dw	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp612cdw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp612cdw	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp622cdw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp622cdw	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp623cdw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp623cdw	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp654cdw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp654cdw	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Lbp664cdw Firmware	All versions

Running on/with	Platform Versions
Canon Lbp664cdw	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Ir1435i Firmware	All versions

Running on/with	Platform Versions
Canon Ir1435i	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon 1435if Firmware	All versions

Running on/with	Platform Versions
Canon 1435if	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon 1435p Firmware	All versions

Running on/with	Platform Versions
Canon 1435p	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon 1435i+ Firmware	All versions

Running on/with	Platform Versions
Canon 1435i+	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon 1435if+ Firmware	All versions

Running on/with	Platform Versions
Canon 1435if+	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon 1435p+ Firmware	All versions

Running on/with	Platform Versions
Canon 1435p+	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Ir1643i Firmware	All versions

Running on/with	Platform Versions
Canon Ir1643i	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Ir1643if Firmware	All versions

Running on/with	Platform Versions
Canon Ir1643if	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Wg7240 Firmware	All versions

Running on/with	Platform Versions
Canon Wg7240	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Wg7250 Firmware	All versions

Running on/with	Platform Versions
Canon Wg7250	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Wg7250f Firmware	All versions

Running on/with	Platform Versions
Canon Wg7250f	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Wg7250z Firmware	All versions

Running on/with	Platform Versions
Canon Wg7250z	All versions

Related CWEs

CWE-122

Heap-based Buffer Overflow

A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio

Source: zdi-disclosures@trendmicro.com

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-514/

Source: zdi-disclosures@trendmicro.com

Third Party AdvisoryVDB Entry

https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctio

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-514/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.