CVE-2024-2184
📋 TL;DR
A buffer overflow vulnerability in the WSD probe request process of certain Canon multifunction and laser printers allows an attacker on the same network segment to crash the device or execute arbitrary code. This affects multiple Canon printer series sold in Japan, the US, and Europe. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- Satera MF740C Series
- Satera MF640C Series
- Satera LBP660C Series
- Satera LBP620C Series
- Satera MF750C Series
- Satera LBP670C Series
- Color imageCLASS MF740C Series
- Color imageCLASS MF640C Series
- Color imageCLASS X MF1127C
- Color imageCLASS LBP664Cdw
- Color imageCLASS LBP622Cdw
- Color imageCLASS X LBP1127C
- Color imageCLASS MF750C Series
- Color imageCLASS X MF1333C
- Color imageCLASS LBP674Cdw
- Color imageCLASS X LBP1333C
- i-SENSYS MF740C Series
- i-SENSYS MF640C Series
- C1127i Series
- i-SENSYS LBP660C Series
- i-SENSYS LBP620C Series
- C1127P
- i-SENSYS MF750C Series
- C1333i Series
- i-SENSYS LBP673Cdw
- C1333P
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with full control of the printer, potentially leading to lateral movement into the network, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service causing the printer to become unresponsive, disrupting printing services and requiring a reboot.
If Mitigated
Limited impact if printers are isolated on a separate VLAN with strict network access controls, preventing unauthorized network access.
🎯 Exploit Status
Exploitation requires network access to the printer's WSD service. No authentication is needed, making it straightforward for attackers on the same network segment.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Canon advisory for specific model updates (e.g., firmware versions beyond v12.07 or v03.09 as applicable)
Vendor Advisory: https://psirt.canon/advisory-information/cp2024-002/
Restart Required: Yes
Instructions:
1. Identify the exact printer model and current firmware version.
2. Visit the Canon advisory URL to find the patched firmware version for your model.
3. Download the firmware update from Canon's official support site.
4. Follow Canon's instructions to apply the firmware update via the printer's web interface or USB.
5. Reboot the printer after the update completes.
🔧 Temporary Workarounds
Disable WSD Protocol
allTurn off the Web Services on Devices (WSD) protocol to block the vulnerable probe request process.
Network Segmentation
allIsolate printers on a separate VLAN with strict firewall rules to limit access to trusted hosts only.
🧯 If You Can't Patch
- Implement strict network access controls to limit printer access to authorized IP addresses only.
- Monitor network traffic for unusual WSD probe requests or attempts to exploit the buffer overflow.
🔍 How to Verify
Check if Vulnerable:
Check the printer's firmware version via its web interface or control panel and compare with affected versions listed in the Canon advisory.Check Version:
Access the printer's web interface (e.g., http://<printer-ip>) and navigate to the firmware or system information page to view the version.Verify Fix Applied:
Confirm the firmware version has been updated to a patched version as specified in the Canon advisory.📡 Detection & Monitoring
Log Indicators:
- Printer logs showing crashes or reboots after WSD requests
- Unusual network traffic to printer ports (typically TCP/3702 for WSD)
Network Indicators:
- Excessive or malformed WSD probe requests to printer IPs
- Traffic patterns indicative of buffer overflow attempts
SIEM Query:
source_ip="*" AND dest_ip="<printer_ip>" AND dest_port=3702 AND (payload_size>normal OR protocol_anomaly)