CVE-2022-24673
This vulnerability allows remote attackers to execute arbitrary code on affected installations of...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Record
CVE-2022-24673- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2022-29545
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Record
EUVD-2022-29545- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-w85v-q239-vpx6
This vulnerability allows remote attackers to execute arbitrary code on affected installations of...
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Record
GHSA-w85v-q239-vpx6- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
NVD
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the SLP protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15845.
- Record
CVE-2022-24673- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
Affected products
- canon imageclass mf644cdw
- canon 1435i\+ firmware
- canon 1435if\+ firmware
- canon 1435if firmware
- canon 1435p\+ firmware
- canon 1435p firmware
- canon d1520 firmware
- canon d1550 firmware
- canon d1620 firmware
- canon d1650 firmware
- canon ir1435i firmware
- canon ir1643i firmware
Show 65 moreShow less
- canon ir1643if firmware
- canon lbp1127c firmware
- canon lbp1238 firmware
- canon lbp1238 ii firmware
- canon lbp214dw firmware
- canon lbp215dw firmware
- canon lbp226dw firmware
- canon lbp227dw firmware
- canon lbp228dw firmware
- canon lbp236dw firmware
- canon lbp237dw firmware
- canon lbp251dw firmware
- canon lbp253dw firmware
- canon lbp612cdw firmware
- canon lbp622cdw firmware
- canon lbp623cdw firmware
- canon lbp654cdw firmware
- canon lbp664cdw firmware
- canon mf1127c firmware
- canon mf1238 firmware
- canon mf1238 ii firmware
- canon mf1643i ii firmware
- canon mf1643if ii firmware
- canon mf414dw firmware
- canon mf416dw firmware
- canon mf419dw firmware
- canon mf424dw firmware
- canon mf426dw firmware
- canon mf429dw firmware
- canon mf445dw firmware
- canon mf448dw firmware
- canon mf449dw firmware
- canon mf451dw firmware
- canon mf452dw firmware
- canon mf453dw firmware
- canon mf455dw firmware
- canon mf515dw firmware
- canon mf525dw firmware
- canon mf543dw firmware
- canon mf6160dw firmware
- canon mf6180dw firmware
- canon mf624cdw firmware
- canon mf628cdw firmware
- canon mf632cdw firmware
- canon mf634cdw firmware
- canon mf641cw firmware
- canon mf642cdw firmware
- canon mf644cdw firmware
- canon mf726cdw firmware
- canon mf729cdw firmware
- canon mf731cdw firmware
- canon mf733cdw firmware
- canon mf735cdw firmware
- canon mf741cdw firmware
- canon mf743cdw firmware
- canon mf745cdw firmware
- canon mf746cdw firmware
- canon mf810cdn firmware
- canon mf820cdn firmware
- canon mf8280cw firmware
- canon mf8580cdw firmware
- canon wg7240 firmware
- canon wg7250 firmware
- canon wg7250f firmware
- canon wg7250z firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-24673 is a high vulnerability (CVSS 8.8) in Canon Imageclass Mf644cdw, published March 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.63%, the 85th percentile. No source names a fixed version.