CVE-2022-24673
📋 TL;DR
CVE-2022-24673 is a critical buffer overflow vulnerability in Canon imageCLASS MF644Cdw printers that allows remote attackers to execute arbitrary code as root without authentication. The flaw exists in the SLP protocol implementation where user-supplied data length isn't properly validated before copying to a fixed buffer. Organizations using affected Canon printers are at risk of complete device compromise.
💻 Affected Systems
- Canon imageCLASS MF644Cdw
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full root access to printer, installs persistent malware, uses printer as pivot point into internal network, and potentially bricks the device.
Likely Case
Remote attacker executes arbitrary code to steal print jobs, credentials, or use printer as part of botnet for DDoS attacks.
If Mitigated
With proper network segmentation and access controls, impact limited to printer compromise without lateral movement.
🎯 Exploit Status
ZDI-CAN-15845 reference suggests exploit development. No authentication required makes exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware version 10.03 or later
Restart Required: Yes
Instructions:
1. Download latest firmware from Canon support site. 2. Upload firmware via printer web interface. 3. Apply update. 4. Reboot printer.
🔧 Temporary Workarounds
Disable SLP Protocol
allDisable Service Location Protocol on affected printers to block exploitation vector
Access printer web interface > Network Settings > Protocol Settings > Disable SLP
Network Segmentation
linuxIsolate printers on separate VLAN with strict firewall rules
# Example firewall rule to block SLP (port 427)
iptables -A INPUT -p udp --dport 427 -j DROP
🧯 If You Can't Patch
- Segment printers on isolated network with no internet access
- Implement strict firewall rules blocking all inbound traffic to printers except essential management ports
🔍 How to Verify
Check if Vulnerable:
Check printer firmware version via web interface: Settings > Device Information > Firmware VersionCheck Version:
curl -s http://printer-ip/ or check web interfaceVerify Fix Applied:
Verify firmware version is 10.03 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual SLP protocol traffic
- Multiple failed buffer overflow attempts
- Printer firmware modification logs
Network Indicators:
- Excessive UDP port 427 traffic to printers
- Unusual outbound connections from printers
SIEM Query:
source="firewall" dest_port=427 AND (protocol="udp" OR protocol="tcp") | stats count by src_ip🔗 References
- https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow
- https://www.zerodayinitiative.com/advisories/ZDI-22-515/
- https://www.usa.canon.com/support/canon-product-advisories/canon-laser-printer-inkjet-printer-and-small-office-multifunctional-printer-measure-against-buffer-overflow
- https://www.zerodayinitiative.com/advisories/ZDI-22-515/
