CVE-2023-6234 Memory corruption in C1333P

Critical 9.8 Published 6 Feb 2024 Updated 2 Aug 2024

A buffer overflow in Canon printer firmware allows network attackers to execute arbitrary code or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-6234?

CVE-2023-6234 is a critical memory corruption vulnerability in Canon Inc. C1333P, published on 6 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*: Satera LBP670C Series/Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware v03.07 and earlier sold in US. i-SENSYS LBP673Cdw/C1333P/i-SENSYS MF750C Series/C1333i Series firmware v03.07 and earlier sold in Europe.

Weakness: CWE-787

Which versions are affected by CVE-2023-6234?

It affects 29 products.

Products include Canon I-Sensys Lbp673cdw Firmware, Canon I-Sensys Mf752cdw Firmware, Canon I-Sensys Mf754cdw Firmware, Canon I-Sensys X C1333i Firmware, Canon I-Sensys X C1333if Firmware, Canon I-Sensys X C1333p Firmware and 23 more.

How do I fix CVE-2023-6234?

No fix has been published for CVE-2023-6234 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-6234 being exploited?

There is no known exploitation of CVE-2023-6234 in the wild and no public exploit code.

Sources

Also known as GHSA-8xpr-jq7w-573j.