CVE-2023-6232 Memory corruption in C1333P
A buffer overflow in Canon printers allows network attackers to execute arbitrary code or cause denial of service via the address book authentication process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-6232?
CVE-2023-6232 is a critical memory corruption vulnerability in Canon Inc. C1333P, published on 6 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.
Weakness: CWE-787
Which versions are affected by CVE-2023-6232?
It affects 29 products.
Products include Canon I-Sensys Lbp673cdw Firmware, Canon I-Sensys Mf752cdw Firmware, Canon I-Sensys Mf754cdw Firmware, Canon I-Sensys X C1333i Firmware, Canon I-Sensys X C1333if Firmware, Canon I-Sensys X C1333p Firmware and 23 more.
How do I fix CVE-2023-6232?
No fix has been published for CVE-2023-6232 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-6232 being exploited?
There is no known exploitation of CVE-2023-6232 in the wild and no public exploit code.
Other vulnerabilities in Canon Inc. C1333P
Sources
Also known as GHSA-vv93-j256-hpwh.