CVE-2025-2146

Published: May 26, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

Affected (37)

Canon

37 products

Satera Mf656cdw Firmware

Satera Mf654cdw Firmware

Satera Mf551dw Firmware

Satera Mf457dw Firmware

Imageclass Mf656cdw Firmware

Imageclass Mf654cdw Firmware

Imageclass Mf653cdw Firmware

Imageclass Mf652cdw Firmware

Imageclass Lbp633cdw Firmware

Imageclass Lbp632cdw Firmware

Imageclass Mf455dw Firmware

Imageclass Mf453dw Firmware

Imageclass Mf452dw Firmware

Imageclass Mf451dw Firmware

Imageclass Lbp237dw Firmware

Imageclass Lbp236dw Firmware

Imageclass X Mf1238 Ii Firmware

Imageclass X Mf1643i Ii Firmware

Imageclass X Mf1643if Ii Firmware

Imageclass X Lbp1238 Ii Firmware

I Sensys Mf657cdw Firmware

I Sensys Mf655cdw Firmware

I Sensys Mf651cdw Firmware

I Sensys Lbp633cdw Firmware

I Sensys Lbp631cdw Firmware

I Sensys Mf553dw Firmware

I Sensys Mf552dw Firmware

I Sensys Mf455dw Firmware

I Sensys Mf453dw Firmware

I Sensys Lbp236dw Firmware

I Sensys Lbp233dw Firmware

Imagerunner 1643if Ii Firmware

Imagerunner 1643i Ii Firmware

I Sensys X 1238if Ii Firmware

I Sensys X 1238i Ii Firmware

I Sensys X 1238p Ii Firmware

I Sensys X 1238pr Ii Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Satera Mf656cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Satera Mf656cdw	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Satera Mf654cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Satera Mf654cdw	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Satera Mf551dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Satera Mf551dw	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Satera Mf457dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Satera Mf457dw	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf656cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf656cdw	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf654cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf654cdw	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf653cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf653cdw	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf652cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf652cdw	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Lbp633cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Lbp633cdw	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Lbp632cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Lbp632cdw	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf455dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf455dw	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf453dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf453dw	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf452dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf452dw	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Mf451dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Mf451dw	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Lbp237dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Lbp237dw	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass Lbp236dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass Lbp236dw	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass X Mf1238 Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass X Mf1238 Ii	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass X Mf1643i Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass X Mf1643i Ii	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass X Mf1643if Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass X Mf1643if Ii	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imageclass X Lbp1238 Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imageclass X Lbp1238 Ii	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf657cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf657cdw	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf655cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf655cdw	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf651cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf651cdw	All versions

Configuration X

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Lbp633cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Lbp633cdw	All versions

Configuration Y

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Lbp631cdw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Lbp631cdw	All versions

Configuration Z

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf553dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf553dw	All versions

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf552dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf552dw	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf455dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf455dw	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Mf453dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Mf453dw	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Lbp236dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Lbp236dw	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys Lbp233dw Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys Lbp233dw	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imagerunner 1643if Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imagerunner 1643if Ii	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon Imagerunner 1643i Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon Imagerunner 1643i Ii	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys X 1238if Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys X 1238if Ii	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys X 1238i Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys X 1238i Ii	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys X 1238p Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys X 1238p Ii	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Canon I Sensys X 1238pr Ii Firmware	Up to 05.07

Running on/with	Platform Versions
Canon I Sensys X 1238pr Ii	All versions

Related CWEs

CWE-787

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://canon.jp/support/support-info/250127vulnerability-response

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://psirt.canon/advisory-information/cp2025-001/

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://www.canon-europe.com/support/product-security/#news

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers

Source: f98c90f0-e9bd-4fa7-911b-51993f3571fd

Vendor Advisory

Timeline

No history available yet.