{"id":"CVE-2025-2146","aliases":["EUVD-2025-27695","GHSA-xcjx-g6h3-96jc"],"status":"published","title":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers...","description":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00915,"percentile":0.60393,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2025-05-25T23:36:36Z","modified":"2026-06-17T09:06:24Z","products":[{"vendor":"canon","product":"i-sensys_lbp233dw_firmware"},{"vendor":"canon","product":"i-sensys_lbp236dw_firmware"},{"vendor":"canon","product":"i-sensys_lbp631cdw_firmware"},{"vendor":"canon","product":"i-sensys_lbp633cdw_firmware"},{"vendor":"canon","product":"i-sensys_mf453dw_firmware"},{"vendor":"canon","product":"i-sensys_mf455dw_firmware"},{"vendor":"canon","product":"i-sensys_mf552dw_firmware"},{"vendor":"canon","product":"i-sensys_mf553dw_firmware"},{"vendor":"canon","product":"i-sensys_mf651cdw_firmware"},{"vendor":"canon","product":"i-sensys_mf655cdw_firmware"},{"vendor":"canon","product":"i-sensys_mf657cdw_firmware"},{"vendor":"canon","product":"i-sensys_x_1238i_ii_firmware"},{"vendor":"canon","product":"i-sensys_x_1238if_ii_firmware"},{"vendor":"canon","product":"i-sensys_x_1238p_ii_firmware"},{"vendor":"canon","product":"i-sensys_x_1238pr_ii_firmware"},{"vendor":"canon","product":"imageclass_lbp236dw_firmware"},{"vendor":"canon","product":"imageclass_lbp237dw_firmware"},{"vendor":"canon","product":"imageclass_lbp632cdw_firmware"},{"vendor":"canon","product":"imageclass_lbp633cdw_firmware"},{"vendor":"canon","product":"imageclass_mf451dw_firmware"},{"vendor":"canon","product":"imageclass_mf452dw_firmware"},{"vendor":"canon","product":"imageclass_mf453dw_firmware"},{"vendor":"canon","product":"imageclass_mf455dw_firmware"},{"vendor":"canon","product":"imageclass_mf652cdw_firmware"},{"vendor":"canon","product":"imageclass_mf653cdw_firmware"},{"vendor":"canon","product":"imageclass_mf654cdw_firmware"},{"vendor":"canon","product":"imageclass_mf656cdw_firmware"},{"vendor":"canon","product":"imageclass_x_lbp1238_ii_firmware"},{"vendor":"canon","product":"imageclass_x_mf1238_ii_firmware"},{"vendor":"canon","product":"imageclass_x_mf1643i_ii_firmware"},{"vendor":"canon","product":"imageclass_x_mf1643if_ii_firmware"},{"vendor":"canon","product":"imagerunner_1643i_ii_firmware"},{"vendor":"canon","product":"imagerunner_1643if_ii_firmware"},{"vendor":"canon","product":"satera_mf457dw_firmware"},{"vendor":"canon","product":"satera_mf551dw_firmware"},{"vendor":"canon","product":"satera_mf654cdw_firmware"},{"vendor":"canon","product":"satera_mf656cdw_firmware"},{"vendor":"canon inc.","product":"color imageclass lbp632cdw"},{"vendor":"canon inc.","product":"color imageclass lbp633cdw"},{"vendor":"canon inc.","product":"color imageclass mf652cdw"},{"vendor":"canon inc.","product":"color imageclass mf653cdw"},{"vendor":"canon inc.","product":"color imageclass mf654cdw"},{"vendor":"canon inc.","product":"color imageclass mf656cdw"},{"vendor":"canon inc.","product":"i-sensys lbp233dw"},{"vendor":"canon inc.","product":"i-sensys lbp236dw"},{"vendor":"canon inc.","product":"i-sensys lbp631cdw"},{"vendor":"canon inc.","product":"i-sensys lbp633cdw"},{"vendor":"canon inc.","product":"i-sensys mf453dw"},{"vendor":"canon inc.","product":"i-sensys mf455dw"},{"vendor":"canon inc.","product":"i-sensys mf552dw"},{"vendor":"canon inc.","product":"i-sensys mf553dw"},{"vendor":"canon inc.","product":"i-sensys mf651cdw"},{"vendor":"canon inc.","product":"i-sensys mf655cdw"},{"vendor":"canon inc.","product":"i-sensys mf657cdw"},{"vendor":"canon inc.","product":"i-sensys x 1238i ii"},{"vendor":"canon inc.","product":"i-sensys x 1238if ii"},{"vendor":"canon inc.","product":"i-sensys x 1238p ii"},{"vendor":"canon inc.","product":"i-sensys x 1238pr ii"},{"vendor":"canon inc.","product":"imageclass lbp236dw"},{"vendor":"canon inc.","product":"imageclass lbp237dw"},{"vendor":"canon inc.","product":"imageclass mf451dw"},{"vendor":"canon inc.","product":"imageclass mf452dw"},{"vendor":"canon inc.","product":"imageclass mf453dw"},{"vendor":"canon inc.","product":"imageclass mf455dw"},{"vendor":"canon inc.","product":"imageclass x lbp1238 ii"},{"vendor":"canon inc.","product":"imageclass x mf1238 ii"},{"vendor":"canon inc.","product":"imageclass x mf1643i ii"},{"vendor":"canon inc.","product":"imageclass x mf1643if ii"},{"vendor":"canon inc.","product":"imagerunner 1643i ii"},{"vendor":"canon inc.","product":"imagerunner 1643if ii"},{"vendor":"canon inc.","product":"satera mf457dw"},{"vendor":"canon inc.","product":"satera mf551dw"},{"vendor":"canon inc.","product":"satera mf654cdw"},{"vendor":"canon inc.","product":"satera mf656cdw"}],"references":[{"url":"https://psirt.canon/advisory-information/cp2025-001/","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://canon.jp/support/support-info/250127vulnerability-response","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://www.canon-europe.com/support/product-security/#news","tags":["vendor-advisory","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2146"},{"url":"https://psirt.canon/advisory-information/cp2025-001"},{"url":"https://github.com/advisories/GHSA-xcjx-g6h3-96jc"}],"sources":{"cve":[{"id":"CVE-2025-2146","description":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.","status":"published","published":"2025-05-25T23:36:36.024Z","modified":"2025-05-27T14:20:02.153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:32:38.70481Z"}],"euvd":[{"id":"EUVD-2025-27695","description":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.","status":"published","published":"2025-05-25T23:36:36Z","modified":"2025-05-27T14:20:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:38.348652Z"}],"ghsa":[{"id":"GHSA-xcjx-g6h3-96jc","title":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers...","description":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.","status":"published","published":"2025-05-26T00:30:33Z","modified":"2025-05-26T00:30:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:02:26.348006Z"}],"nvd":[{"id":"CVE-2025-2146","description":"Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.","status":"published","published":"2025-05-26T00:15:19.9Z","modified":"2026-06-17T09:06:24.817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:11:09.562272Z"}]}}