CVE-2025-2146 
Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera MF656Cdw/Satera MF654Cdw/Satera MF551dw/Satera MF457dw firmware v05.07 and earlier sold in Japan. Color imageCLASS MF656Cdw/Color imageCLASS MF654Cdw/Color imageCLASS MF653Cdw/Color imageCLASS MF652Cdw/Color imageCLASS LBP633Cdw/Color imageCLASS LBP632Cdw/imageCLASS MF455dw/imageCLASS MF453dw/imageCLASS MF452dw/imageCLASS MF451dw/imageCLASS LBP237dw/imageCLASS LBP236dw/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II/imageCLASS X LBP1238 II firmware v05.07 and earlier sold in US. i-SENSYS MF657Cdw/i-SENSYS MF655Cdw/i-SENSYS MF651Cdw/i-SENSYS LBP633Cdw/i-SENSYS LBP631Cdw/i-SENSYS MF553dw/i-SENSYS MF552dw/i-SENSYS MF455dw/i-SENSYS MF453dw/i-SENSYS LBP236dw/i-SENSYS LBP233dw/imageRUNNER 1643iF II/imageRUNNER 1643i II/i-SENSYS X 1238iF II/i-SENSYS X 1238i II/i-SENSYS X 1238P II/i-SENSYS X 1238Pr II firmware v05.07 and earlier sold in Europe.
Problem types: cwe_id: CWE-787
description: CWE-787: Out-of-bounds Write
Affected products: vendor: Canon Inc.
product: Satera MF656Cdw
vendor: Canon Inc.
product: Satera MF654Cdw
vendor: Canon Inc.
product: Satera MF551dw
vendor: Canon Inc.
product: Satera MF457dw
vendor: Canon Inc.
product: Color imageCLASS MF656Cdw
vendor: Canon Inc.
product: Color imageCLASS MF654Cdw
vendor: Canon Inc.
product: Color imageCLASS MF653Cdw
vendor: Canon Inc.
product: Color imageCLASS MF652Cdw
vendor: Canon Inc.
product: Color imageCLASS LBP633Cdw
vendor: Canon Inc.
product: Color imageCLASS LBP632Cdw
vendor: Canon Inc.
product: imageCLASS MF455dw
vendor: Canon Inc.
product: imageCLASS MF453dw
vendor: Canon Inc.
product: imageCLASS MF452dw
vendor: Canon Inc.
product: imageCLASS MF451dw
vendor: Canon Inc.
product: imageCLASS LBP237dw
vendor: Canon Inc.
product: imageCLASS LBP236dw
vendor: Canon Inc.
product: imageCLASS X MF1238 II
vendor: Canon Inc.
product: imageCLASS X MF1643i II
vendor: Canon Inc.
product: imageCLASS X MF1643iF II
vendor: Canon Inc.
product: imageCLASS X LBP1238 II
vendor: Canon Inc.
product: i-SENSYS MF657Cdw
vendor: Canon Inc.
product: i-SENSYS MF655Cdw
vendor: Canon Inc.
product: i-SENSYS MF651Cdw
vendor: Canon Inc.
product: i-SENSYS LBP633Cdw
vendor: Canon Inc.
product: i-SENSYS LBP631Cdw
vendor: Canon Inc.
product: i-SENSYS MF553dw
vendor: Canon Inc.
product: i-SENSYS MF552dw
vendor: Canon Inc.
product: i-SENSYS MF455dw
vendor: Canon Inc.
product: i-SENSYS MF453dw
vendor: Canon Inc.
product: i-SENSYS LBP236dw
vendor: Canon Inc.
product: i-SENSYS LBP233dw
vendor: Canon Inc.
product: imageRUNNER 1643iF II
vendor: Canon Inc.
product: imageRUNNER 1643i II
vendor: Canon Inc.
product: i-SENSYS X 1238iF II
vendor: Canon Inc.
product: i-SENSYS X 1238i II
vendor: Canon Inc.
product: i-SENSYS X 1238P II
vendor: Canon Inc.
product: i-SENSYS X 1238Pr II
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-05-25T23:36:36.024Z