CVE-2022-24672 in imageCLASS MF644Cdw
Summary
by MITRE • 03/28/2023
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CADM service. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15802.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/03/2026
The CVE-2022-24672 vulnerability represents a critical buffer overflow flaw in Canon imageCLASS MF644Cdw printers running firmware version 10.02, specifically within the CADM service component. This vulnerability exposes devices to remote code execution attacks without requiring any authentication credentials, making it particularly dangerous for network-adjacent attackers who can exploit the flaw from within the same network segment. The vulnerability stems from inadequate input validation mechanisms that fail to properly check the length of user-supplied data before copying it into a fixed-length heap-based buffer, creating a classic buffer overflow condition that can be leveraged for arbitrary code execution.
The technical implementation of this vulnerability falls under CWE-121, which describes heap-based buffer overflow conditions where insufficient bounds checking allows attackers to overwrite adjacent memory locations. The CADM service operates with elevated privileges, meaning that successful exploitation would allow attackers to execute code in the context of the service account, potentially leading to complete system compromise. This privilege escalation occurs because the service runs with higher permissions than typical user applications, making the attack vector particularly severe for network-adjacent threat actors who can access the printer's network services directly.
From an operational perspective, this vulnerability creates significant risk for organizations that rely on Canon printers as part of their network infrastructure, particularly in environments where printer network access is not properly segmented from critical systems. The lack of authentication requirements means that any attacker with network access to the printer can exploit this vulnerability, potentially enabling them to establish persistent backdoors, exfiltrate sensitive data, or use the compromised printer as a pivot point for attacking other network resources. The impact extends beyond simple code execution, as the compromised device could serve as a staging point for broader network infiltration activities.
Organizations should implement immediate mitigations including network segmentation to isolate printer devices from critical network segments, applying firmware updates from Canon as soon as they become available, and monitoring network traffic for suspicious activity related to the CADM service. The vulnerability also aligns with ATT&CK technique T1059.007 for command and scripting interpreter, where attackers could use the compromised printer to execute malicious commands. Additionally, this vulnerability demonstrates the importance of secure coding practices and input validation as outlined in MITRE's ATT&CK framework, where proper bounds checking and memory management could prevent such buffer overflow conditions from being exploited in the first place.