CVE-2022-43608 — HIGH (8.8)

Vulnerability Description

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BJNP service. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-16032.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Canon	Mf644Cdw Firmware	10.03
Canon	Mf644Cdw	-

Related Weaknesses (CWE)

CWE-190

References

https://www.psirt.canon/advisory-information/cve-2022-43608_20221125Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1666/Third Party AdvisoryVDB Entry
https://www.psirt.canon/advisory-information/cve-2022-43608_20221125Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-22-1666/Third Party AdvisoryVDB Entry

FAQ

What is CVE-2022-43608?

CVE-2022-43608 is a vulnerability with a CVSS score of 8.8 (HIGH). This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentication is not required to exploit this vul...

How severe is CVE-2022-43608?

CVE-2022-43608 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-43608?

Check the references section above for vendor advisories and patch information. Affected products include: Canon Mf644Cdw Firmware, Canon Mf644Cdw.