CVE-2023-0859

Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office...

2.2 Low

Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Series/LBP620C Series/MF740C Series/MF640C Series firmware Ver.11.04 and earlier sold in Japan. Color imageCLASS LBP660C Series/LBP 620C Series/X LBP1127C/MF740C Series/MF640C Series/X MF1127C firmware Ver.11.04 and earlier sold in US. i-SENSYS LBP660C Series/LBP620C Series/MF740C Series/MF640C Series, C1127P, C1127iF, C1127i firmware Ver.11.04 and earlier sold in Europe.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.54%Up 0.5 points since May 12, 2023

What each source reports

CVE List Score used 2.2

Record: CVE-2023-0859
CVSS 3.1: 2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-1285
Updated: 2026-11-02

EUVDEUVD-2023-12857 2.2

Record: EUVD-2023-12857
CVSS 3.1: 2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vpmg-66f3-9f7w 2.2

Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office...

Record: GHSA-vpmg-66f3-9f7w
CVSS 3.1: 2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-1285
Updated: 2026-11-02

NVD 2.2

Record: CVE-2023-0859
CVSS 3.1: 2.2 LowCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-1285
Updated: 2026-11-02

Affected products

Show 34 moreShow less

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-0859 is a low vulnerability (CVSS 2.2) in Canon Mf1127c Firmware, published May 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. No source names a fixed version.