CVE-2021-38085: The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite…

PriorityP345high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EXPLOIT

EPSS

1.01%

58.7th percentile

The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).

Affected

1 ranges

Vendor	Product	Version range	Fixed in
canon	pixma_tr150_firmware	<= 3.71.2.10	—

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.