CVE-2023-6229: Canon MF755Cdw Buffer Overflow Vulnerability

CVE-2023-6229 Overview

CVE-2023-6229 is a buffer overflow vulnerability in the CPCA PDL Resource Download process of Canon Office Multifunction Printers and Laser Printers. An attacker on the same network segment can send crafted data to the affected device, causing the printer to become unresponsive or execute arbitrary code. The flaw affects firmware version v03.07 and earlier across Satera, Color imageCLASS, and i-SENSYS product lines distributed in Japan, the United States, and Europe. Canon Product Security Incident Response Team (PSIRT) published advisory CP2024-001 documenting the issue and patched firmware availability.

Critical Impact
Network-adjacent attackers can achieve unauthenticated remote code execution or denial of service against vulnerable Canon printers without user interaction.

Affected Products

Canon Color imageCLASS / i-SENSYS / Satera MF750C, MF755CDW, MF753CDW, MF751CDW, MF754CDW, MF752CDW series (firmware v03.07 and earlier)
Canon Color imageCLASS / i-SENSYS / Satera LBP670C, LBP674C, LBP674CDW, LBP673CDW, LBP672C, LBP671C series (firmware v03.07 and earlier)
Canon i-SENSYS X C1333i, C1333if, C1333P and imageCLASS X LBP1333C / MF1333C series (firmware v03.07 and earlier)

Discovery Timeline

2024-02-06 - CVE-2023-6229 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-6229

Vulnerability Analysis

The vulnerability resides in the Canon Peripheral Communication Architecture (CPCA) Page Description Language (PDL) Resource Download process. The CPCA service handles printer resource transfer operations over the network. The service fails to validate the size of incoming data before copying it into a fixed-size buffer, resulting in an out-of-bounds write classified under [CWE-787]. The bug is reachable without authentication from any host on the same network segment as the printer.

Successful exploitation leads to two distinct outcomes. The device may crash and become unresponsive, requiring manual intervention to restore service. Alternatively, a precisely crafted payload may overwrite control structures in memory and redirect execution flow, enabling arbitrary code execution on the printer firmware.

Root Cause

The root cause is the absence of bounds checking on attacker-supplied length fields during PDL resource download operations. When the CPCA handler copies resource data into its internal buffer, it trusts the size value provided in the protocol message. An oversized value causes adjacent memory to be overwritten, corrupting stack or heap structures depending on the allocation context.

Attack Vector

Exploitation requires network reachability to the printer's CPCA service port. An attacker sends a malformed PDL Resource Download request containing data exceeding the destination buffer length. Because Canon printers are commonly deployed in shared office networks without segmentation, any compromised workstation or rogue device on the same LAN can reach the vulnerable service. No credentials, user interaction, or prior foothold on the printer are required.

No public proof-of-concept exploit code has been released for this vulnerability. Canon's PSIRT advisory describes the flaw in prose only. Refer to the Canon PSIRT Advisory CP2024-001 for technical details.

Detection Methods for CVE-2023-6229

Indicators of Compromise

Unexpected reboots, crashes, or unresponsiveness of Canon LBP or MF series printers on the network
Outbound network connections from printer IP addresses to external or unusual internal hosts
Print jobs or resource download requests originating from non-print-server endpoints
Firmware version strings reporting v03.07 or earlier on affected models after patch release

Detection Strategies

Inventory all networked Canon multifunction and laser printers and cross-reference firmware versions against the affected list in advisory CP2024-001
Monitor printer management protocol traffic (BJNP, CPCA) for malformed or oversized PDL resource download requests
Deploy network intrusion detection rules that alert on anomalous binary payloads directed at printer service ports

Monitoring Recommendations

Capture and baseline normal CPCA and printing traffic volumes to identify spikes consistent with exploitation attempts
Forward printer syslog and SNMP trap data to a centralized SIEM for correlation with endpoint events
Alert on lateral movement patterns where a workstation initiates direct printer protocol sessions outside of normal print spooler activity

How to Mitigate CVE-2023-6229

Immediate Actions Required

Apply the patched firmware released by Canon for each affected model as listed in Canon PSIRT Advisory CP2024-001
Restrict network access to printers using firewall rules or VLAN segmentation so only authorized print servers and clients can reach printer management ports
Disable internet-facing exposure of any Canon printer immediately and verify exposure using internal asset discovery scans

Patch Information

Canon has released firmware updates addressing CVE-2023-6229 for all affected models. Customers should consult the regional Canon support portals: Canon Vulnerability Response (Japan), Canon Europe Security News, and the Canon USA Service Notice on Buffer Overflow. Verify the updated firmware version is later than v03.07 after installation.

Workarounds

Place affected printers behind a private firewall or on a dedicated printer VLAN with access control lists limiting source IPs
Use a global IP address only when necessary and never expose printer management interfaces directly to the internet
Disable unused network services and protocols on the printer's administrative console to reduce attack surface

bash

# Example firewall rule to restrict printer access to a dedicated print server
iptables -A FORWARD -s 10.10.20.5 -d 10.10.50.0/24 -p tcp --dport 9100 -j ACCEPT
iptables -A FORWARD -d 10.10.50.0/24 -p tcp --dport 9100 -j DROP
iptables -A FORWARD -d 10.10.50.0/24 -p udp --dport 8611 -j DROP