CVE-2024-0244

published 2024-02-06

CVE-2024-0244: Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to…

Priority P2 61 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code.*:Satera MF750C Series firmware v03.07 and earlier sold in Japan. Color imageCLASS MF750C Series/Color imageCLASS X MF1333C firmware v03.07 and earlier sold in US. i-SENSYS MF754Cdw/C1333iF firmware v03.07 and earlier sold in Europe.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
canon	i-sensys_mf754cdw_firmware	<= 03.07	—
canon	i-sensys_x_c1333if_firmware	<= 03.07	—
canon	lbp1333c_firmware	<= 03.07	—
canon	mf1333c_firmware	<= 03.07	—
canon	mf751cdw_firmware	<= 03.07	—
canon	mf753cdw_firmware	<= 03.07	—
canon	mf755cdw_firmware	<= 03.07	—
canon_inc	c1333if	—	—
canon_inc	color_imageclass_mf750c_series	—	—
canon_inc	color_imageclass_x_mf1333c	—	—
canon_inc	i-sensys_mf754cdw	—	—
canon_inc	satera_mf750c_series	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → The vulnerability is a buffer overflow in the CPCA PCFAX number processing component of Canon multifunction/laser printers. Detection should focus on anomalous or oversized PCFAX number fields in network traffic targeting affected Canon printer models. ↗
• → Attack vector is network-segment local (adjacent network); monitor for unexpected traffic or crash/unresponsive behavior on Canon Satera MF750C Series, Color imageCLASS MF750C Series/X MF1333C, and i-SENSYS MF754Cdw/C1333iF devices. ↗

• · Affected firmware versions are v03.07 and earlier across three regional product lines: Satera MF750C Series (Japan), Color imageCLASS MF750C Series/Color imageCLASS X MF1333C (US), and i-SENSYS MF754Cdw/C1333iF (Europe). Scope detection/patching efforts to these specific firmware versions. ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-787