InfoSecBulletin Cybersecurity for mankind
Canon has issued a security alert for its laser and small office printers, revealing seven critical vulnerabilities that could let remote attackers fully control the devices. These flaws, which all have a CVSS score of 9.8, impact many imageCLASS, i-SENSYS, and Satera models available in the US, Europe, and Japan.
The main issue is how these printers handle network traffic when unprotected by a firewall. According to the advisory, the risk is acute “if a product is connected directly to the Internet without using a router (wired or Wi-Fi)”.
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
An unauthenticated remote attacker could exploit a vulnerability to cause a buffer overflow or invalid free, which may allow them to execute arbitrary code or cause a Denial-of-Service (DoS) attack. Essentially, a hacker could take control of the printer to steal documents, gain access to the network, or crash it permanently.
The advisory details a barrage of buffer overflow and memory corruption issues, each assigned the near-maximum severity score of 9.8.
CVE-2025-14231: Buffer overflow in “print job processing by WSD”.
CVE-2025-14232: Buffer overflow in “XML processing of XPS file”.
CVE-2025-14233: Invalid free in “CPCA file deletion processing”.
CVE-2025-14234: Buffer overflow in “CPCA list processing”.
CVE-2025-14235: Buffer overflow in “XPS font fpgm data processing”.
CVE-2025-14236: Buffer overflow in “Address Book attribute tag processing”.
CVE-2025-14237: Buffer overflow in “XPS font parse processing”.
Vulnerabilities affect devices with firmware v06.02 and earlier, and the specific models vary by region.
US: Color imageCLASS LBP630C/MF650C, imageCLASS LBP230, X LBP1238 II, and others.
Europe: i-SENSYS LBP630C/MF650C, imageRUNNER 1643i II, and others.
Japan: Satera LBP670C and MF750C Series.
“We advise that our customers install the latest firmware available,” the company stated, noting that fixes will be uploaded to local sales representative websites .
Physical isolation is currently the best defense. Canon recommends customers to set a private IP address for their products and use a firewall or router to limit network access.
