CVE-2024-12649
Description
Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw firmware v05.04 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw firmware v05.04 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw firmware v05.04 and earlier sold in Europe.
How to fix
- psirt.canon/advisory-information/cp2025-001/
- canon.jp/support/support-info/250127vulnerability-response
- usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers
- canon-europe.com/support/product-security/#news
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| canon mf656cdw_firmware | v ≤ 05.04 | — |
| canon mf455dw_firmware | v ≤ 05.04 | — |
| canon mf453dw_firmware | v ≤ 05.04 | — |
| canon mf452dw_firmware | v ≤ 05.04 | — |
| canon mf451dw_firmware | v ≤ 05.04 | — |
| canon mf465dw_firmware | v ≤ 05.04 | — |
| canon mf462dw_firmware | v ≤ 05.04 | — |
| canon mf654cdw_firmware | v ≤ 05.04 | — |
| canon mf653cdw_firmware | v ≤ 05.04 | — |
| canon mf652cw_firmware | v ≤ 05.04 | — |
| canon mf1238_ii_firmware | v ≤ 05.04 | — |
| canon mf1440_firmware | v ≤ 05.04 | — |
| canon mf1643if_ii_firmware | v ≤ 05.04 | — |
| canon mf1643i_ii_firmware | v ≤ 05.04 | — |
| canon lbp237dw_firmware | v ≤ 05.04 | — |
| canon lbp236dw_firmware | v ≤ 05.04 | — |
| canon lbp247dw_firmware | v ≤ 05.04 | — |
| canon lbp246dw_firmware | v ≤ 05.04 | — |
| canon lbp633cdw_firmware | v ≤ 05.04 | — |
| canon lbp632cdw_firmware | v ≤ 05.04 | — |
| canon lbp1238_ii_firmware | v ≤ 05.04 | — |
| canon lbp1440_firmware | v ≤ 05.04 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.