Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an…

Description

Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.

Scores

EPSS (exploitation in 30 days)

0.92% · top 40% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-787: Out-of-bounds Write (opens in a new tab)All about CWE-787 and its CVEs

Affected products

• Canon Inc. · Satera MF656Cdw

  • affected 05.07 and earlier

• Canon Inc. · Satera MF654Cdw

  • affected 05.07 and earlier

• Canon Inc. · Satera MF551dw

  • affected 05.07 and earlier

• Canon Inc. · Satera MF457dw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS MF656Cdw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS MF654Cdw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS MF653Cdw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS MF652Cdw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS LBP633Cdw

  • affected 05.07 and earlier

• Canon Inc. · Color imageCLASS LBP632Cdw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS MF455dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS MF453dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS MF452dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS MF451dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS LBP237dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS LBP236dw

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS X MF1238 II

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS X MF1643i II

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS X MF1643iF II

  • affected 05.07 and earlier

• Canon Inc. · imageCLASS X LBP1238 II

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF657Cdw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF655Cdw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF651Cdw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS LBP633Cdw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS LBP631Cdw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF553dw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF552dw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF455dw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS MF453dw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS LBP236dw

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS LBP233dw

  • affected 05.07 and earlier

• Canon Inc. · imageRUNNER 1643iF II

  • affected 05.07 and earlier

• Canon Inc. · imageRUNNER 1643i II

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS X 1238iF II

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS X 1238i II

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS X 1238P II

  • affected 05.07 and earlier

• Canon Inc. · i-SENSYS X 1238Pr II

  • affected 05.07 and earlier

References (4)

• https://psirt.canon/advisory-information/cp2025-001/ (opens in a new tab)vendor-advisory
• https://canon.jp/support/support-info/250127vulnerability-response (opens in a new tab)vendor-advisory
• https://www.usa.canon.com/support/canon-product-advisories/service-notice-regarding-vulnerability-measure-against-buffer-overflow-for-laser-printers-and-small-office-multifunctional-printers (opens in a new tab)vendor-advisory
• https://www.canon-europe.com/support/product-security/#news (opens in a new tab)vendor-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-2146](https://trackcve.app/badge/CVE-2025-2146.svg)](https://trackcve.app/cve/CVE-2025-2146)

Record last updated 27 May 2025, 14:20 UTC.