Canon Satera MF656Cdw up to 05.07 WebService Authentication out-of-bounds write

Summaryinfo

A vulnerability was found in Canon Satera MF656Cdw, Satera MF654Cdw, Satera MF551dw, Satera MF457dw, Color imageCLASS MF656Cdw, Color imageCLASS MF654Cdw, Color imageCLASS MF653Cdw, Color imageCLASS MF652Cdw, Color imageCLASS LBP633Cdw, Color imageCLASS LBP632Cdw, imageCLASS MF455dw, imageCLASS MF453dw, imageCLASS MF452dw, imageCLASS MF451dw, imageCLASS LBP237dw, imageCLASS LBP236dw, imageCLASS X MF1238 II, imageCLASS X MF1643i II, imageCLASS X MF1643iF II, imageCLASS X LBP1238 II, i-SENSYS MF657Cdw, i-SENSYS MF655Cdw, i-SENSYS MF651Cdw, i-SENSYS LBP633Cdw, i-SENSYS LBP631Cdw, i-SENSYS MF553dw, i-SENSYS MF552dw, i-SENSYS MF455dw, i-SENSYS MF453dw, i-SENSYS LBP236dw, i-SENSYS LBP233dw, imageRUNNER 1643iF II, imageRUNNER 1643i II, i-SENSYS X 1238iF II, i-SENSYS X 1238i II, i-SENSYS X 1238P II and i-SENSYS X 1238Pr II up to 05.07. It has been rated as critical. This impacts an unknown function of the component WebService Authentication. Performing a manipulation results in out-of-bounds write. This vulnerability is known as CVE-2025-2146. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as very critical has been found in Canon Satera MF656Cdw, Satera MF654Cdw, Satera MF551dw, Satera MF457dw, Color imageCLASS MF656Cdw, Color imageCLASS MF654Cdw, Color imageCLASS MF653Cdw, Color imageCLASS MF652Cdw, Color imageCLASS LBP633Cdw, Color imageCLASS LBP632Cdw, imageCLASS MF455dw, imageCLASS MF453dw, imageCLASS MF452dw, imageCLASS MF451dw, imageCLASS LBP237dw, imageCLASS LBP236dw, imageCLASS X MF1238 II, imageCLASS X MF1643i II, imageCLASS X MF1643iF II, imageCLASS X LBP1238 II, i-SENSYS MF657Cdw, i-SENSYS MF655Cdw, i-SENSYS MF651Cdw, i-SENSYS LBP633Cdw, i-SENSYS LBP631Cdw, i-SENSYS MF553dw, i-SENSYS MF552dw, i-SENSYS MF455dw, i-SENSYS MF453dw, i-SENSYS LBP236dw, i-SENSYS LBP233dw, imageRUNNER 1643iF II, imageRUNNER 1643i II, i-SENSYS X 1238iF II, i-SENSYS X 1238i II, i-SENSYS X 1238P II and i-SENSYS X 1238Pr II up to 05.07. This affects an unknown function of the component WebService Authentication. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

It is possible to read the advisory at psirt.canon. This vulnerability is uniquely identified as CVE-2025-2146 since 03/10/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/26/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Canon

Name

• Color imageCLASS LBP632Cdw
• Color imageCLASS LBP633Cdw
• Color imageCLASS MF652Cdw
• Color imageCLASS MF653Cdw
• Color imageCLASS MF654Cdw
• Color imageCLASS MF656Cdw
• i-SENSYS LBP233dw
• i-SENSYS LBP236dw
• i-SENSYS LBP631Cdw
• i-SENSYS LBP633Cdw
• i-SENSYS MF453dw
• i-SENSYS MF455dw
• i-SENSYS MF552dw
• i-SENSYS MF553dw
• i-SENSYS MF651Cdw
• i-SENSYS MF655Cdw
• i-SENSYS MF657Cdw
• i-SENSYS X 1238iF II
• i-SENSYS X 1238i II
• i-SENSYS X 1238P II
• i-SENSYS X 1238Pr II
• imageCLASS LBP236dw
• imageCLASS LBP237dw
• imageCLASS MF451dw
• imageCLASS MF452dw
• imageCLASS MF453dw
• imageCLASS MF455dw
• imageCLASS X LBP1238 II
• imageCLASS X MF1238 II
• imageCLASS X MF1643iF II
• imageCLASS X MF1643i II
• imageRUNNER 1643iF II
• imageRUNNER 1643i II
• Satera MF457dw
• Satera MF551dw
• Satera MF654Cdw
• Satera MF656Cdw

Version

• 05.07

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion