CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2025-14233

CVSS 9.3v4.0pub. 2026-01-16upd. 2026-01-26

Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product being unresponsive or to execute arbitrary code. *: Satera LBP670C Series/Satera MF750C Series firmware v06.02 and earlier sold in Japan.Color imageCLASS LBP630C/Color imageCLASS MF650C Series/imageCLASS LBP230 Series/imageCLASS X LBP1238 II/imageCLASS MF450 Series/imageCLASS X MF1238 II/imageCLASS X MF1643i II/imageCLASS X MF1643iF II firmware v06.02 and earlier sold in US.i-SENSYS LBP630C Series/i-SENSYS MF650C Series/i-SENSYS LBP230 Series/1238P II/1238Pr II/i-SENSYS MF450 Series/i-SENSYS MF550 Series/1238i II/1238iF II/imageRUNNER 1643i II/imageRUNNER 1643iF II firmware v06.02 and earlier sold in Europe.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The bug consists of improper memory deallocation (invalid free) during file deletion handling in the CPCA firmware component of the printer. An attacker present in the same network segment can send a crafted request that triggers the faulty memory operation. The result can be a device crash (unresponsiveness) or — in case of successful exploitation — execution of arbitrary code on the vulnerable device. The vulnerability does not require authentication or user interaction.

Impact

An attacker can cause permanent unresponsiveness of the printer (DoS) or execute arbitrary code on the device, taking full control of it.

Mitigation & patch

Firmware on affected devices should be updated to a version newer than v06.02, applying patches available from the manufacturer. Detailed instructions and update files are available in official Canon advisories: https://psirt.canon/advisory-information/cp2026-001/ and on Canon regional support pages (Japan, USA, Europe). Additionally, it is recommended to restrict network access to printing devices — for example through network segmentation or firewall — so that devices are not accessible from untrusted segments.

Who is affected

Canon devices with firmware v06.02 and earlier: Satera LBP670C Series / Satera MF750C Series (Japan); Color imageCLASS LBP630C / Color imageCLASS MF650C Series / imageCLASS LBP230 Series / imageCLASS X LBP1238 II / imageCLASS MF450 Series / imageCLASS X MF1238 II / imageCLASS X MF1643i II / imageCLASS X MF1643iF II (USA); i-SENSYS LBP630C Series / i-SENSYS MF650C Series / i-SENSYS LBP230 Series / 1238P II / 1238Pr II / i-SENSYS MF450 Series / i-SENSYS MF550 Series / 1238i II / 1238iF II / imageRUNNER 1643i II / imageRUNNER 1643iF II (Europe). Products mentioned in the report: Canon MF455DW, Canon LBP237DW, Canon LBP236DW.

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X