CVE-2024-0244 · Canon Small Office MFP CPCA PCFAX Number Buffer Overflow

01 · The Real Story

Canon scored a copier bug like it was a domain controller zero-day

CVE-2024-0244 is a stack-based buffer overflow in the CPCA (Canon Proprietary Control Architecture) PCFAX number processing code running on Canon small-office multifunction printers and laser printers. The affected firmware is version 03.07 and earlier across regional model families: i-SENSYS MF754Cdw / MF752Cdw / LBP673Cdw / C1333i / C1333iF / C1333P (Europe), Color imageCLASS MF753Cdw / MF751Cdw / MF1333C / LBP674Cdw / LBP1333C (North America), and Satera MF750C / LBP670C (Japan). An unauthenticated attacker who can reach the printer's network interface can send a crafted CPCA packet to overflow the buffer, potentially achieving arbitrary code execution on the printer's embedded ARM processor or causing a denial-of-service condition. The flaw was reported by Connor Ford (@ByteInsight) of Nettitude through Trend Micro's Zero Day Initiative.

Canon's CVSS 9.8 CRITICAL rating is technically defensible on paper — the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H implies trivial remote exploitation — but it ignores three compounding realities. First, Canon's own advisory clarifies the attacker must be *on the same network segment* or the printer must have a public IP without a router; in enterprise environments this means the attacker is already post-initial-access. Second, the target is a small-office printer appliance, not a server, domain controller, or security-critical infrastructure — full compromise yields control of an embedded device, not a Windows domain. Third, there is no public proof-of-concept, no known in-the-wild exploitation, and EPSS sits at 1.38% — the actuarial odds of exploitation are negligible. The 9.8 is vendor CYA scoring, not operational reality.

"A 9.8 on a printer behind your firewall is not a 9.8 in your environment."

02 · The Attack Path

4 steps from start to impact.

STEP 01

Attain same-segment network access

The attacker must reach the printer's CPCA service port on the local network. In an enterprise, this means the attacker has already compromised another host on the same VLAN or has physical access to the network segment. Canon's advisory explicitly states the attack requires the device to be on the same network segment or directly internet-exposed. Very few enterprises expose printer management ports externally.

Conditions required:

Attacker has network access to the same VLAN/subnet as the target printer
Printer's CPCA service port is reachable (not firewalled between segments)

Where this breaks in practice:

Enterprise printers sit behind NAT/firewall — not internet-routable
Microsegmentation or VLAN isolation blocks cross-segment access in mature environments
Assumes attacker already has internal network foothold (post-initial-access)

Detection/coverage: Network IDS signatures for anomalous CPCA protocol traffic would flag this, but few organizations monitor printer protocol traffic specifically.

STEP 02

Send crafted CPCA PCFAX packet

The attacker sends a malformed CPCA packet targeting the PCFAX number processing function. The overflow occurs because the firmware fails to validate the length of the fax number field before copying it into a fixed-size stack buffer. No authentication is required for this interaction — the CPCA protocol on Canon printers does not enforce access controls at the protocol level. No known weaponized tooling or public PoC exists for this step.

Conditions required:

Knowledge of the CPCA protocol structure (proprietary, not publicly documented)
Ability to craft and send raw network packets to the printer

Where this breaks in practice:

CPCA is a proprietary Canon protocol with no public documentation — exploit development requires reverse engineering the firmware
No public PoC or exploit framework module exists as of September 2026
ZDI coordinated disclosure typically embargoes technical details

Detection/coverage: No Snort/Suricata signatures or Nessus/Qualys plugins specifically detect CVE-2024-0244 exploitation attempts.

STEP 03

Achieve code execution on embedded ARM processor

Successful exploitation gives the attacker arbitrary code execution on the printer's embedded ARM processor running Canon's real-time OS. This is not a Windows or Linux shell — it is a constrained embedded environment with limited tooling. The attacker can persist on the printer, intercept print/scan/fax jobs, and potentially use the device as a pivot point for lateral movement on the network.

Conditions required:

Successful buffer overflow exploitation
Bypass of any ASLR/DEP equivalent on the embedded platform (unlikely to be present on small-office printer firmware)

Where this breaks in practice:

Embedded ARM RTOS environment severely limits post-exploitation utility compared to a compromised server or workstation
No standard C2 frameworks support Canon printer firmware as an implant target
Persistence survives until firmware update or factory reset

Detection/coverage: Compromised printers may exhibit anomalous network connections or traffic patterns detectable by NDR solutions. No EDR agent runs on these devices.

STEP 04

Leverage printer as network pivot or document intercept

With control of the printer, the attacker can passively intercept documents sent to the device (print jobs, scanned documents, faxes) and potentially use the device's network position for lateral movement. The printer sits on the corporate network with a trusted IP, potentially bypassing host-based controls on other systems. However, the attacker is constrained by the limited embedded OS and the printer's typical network permissions.

Conditions required:

Successful code execution on the printer
Printer processes sensitive documents or has reachable network targets

Where this breaks in practice:

Document interception requires the printer to actually be in use for sensitive material
Lateral movement from a printer is atypical — most attack frameworks have no modules for pivoting from embedded printer OS
Network access from the printer is limited to what the printer's VLAN ACLs allow

Detection/coverage: NDR/NTA solutions should detect unusual outbound connections from printer IP addresses. SIEM correlation of printer-to-server connections would be anomalous.

03 · Compensating Control

Isolate printers on a dedicated VLAN with strict ACLs — Place all Canon MFPs on a print-only VLAN that permits traffic only from print servers and management stations. Block all outbound internet from the printer VLAN. This eliminates both the internet-exposure vector and limits lateral movement from a compromised printer. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.

Disable unused network protocols including CPCA fax services — If PCFAX functionality is not in use, disable it in the printer's web management interface under Network Settings. This removes the vulnerable code path entirely. Consult Canon documentation for your specific model variant.

Apply Canon firmware updates within the 365-day remediation window — Download and apply the latest firmware from your regional Canon support portal. Canon released patches in February 2024 via advisory CP2024-001. Firmware updates on printers typically require manual intervention per device or deployment via Canon's fleet management tools.

Monitor printer network traffic with NDR/NTA — Configure your network detection and response platform to alert on anomalous outbound connections from printer IP addresses — especially connections to external IPs, DNS queries for non-printing domains, or unusual protocol usage. This compensates for the lack of endpoint detection on embedded devices.

Restrict printer web management interface access — Limit access to the printer's HTTP/HTTPS management interface to authorized administrator IP addresses only. This prevents attackers from using the management interface for reconnaissance even if they reach the printer's network segment.

What doesn't work

EDR/antivirus on the printer — these are embedded ARM RTOS devices with no agent support. Your endpoint security stack is blind to printer compromise.
Patch management automation (WSUS/SCCM/Intune) — enterprise patch management tools do not manage Canon printer firmware. Updates are manual or require Canon-specific fleet tools.
WAF or reverse proxy — the CPCA protocol is not HTTP-based. Web application firewalls do not inspect or filter CPCA traffic.
Network-level TLS inspection — CPCA is a proprietary binary protocol, not TLS-wrapped. DPI/TLS inspection appliances will not decode or filter it.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	None observed. No reports from Canon, ZDI, or any threat intelligence source of active exploitation. No campaigns attributed to this CVE.
Proof-of-Concept	None public. Discovered by Connor Ford (`@ByteInsight`) of Nettitude via ZDI (ZDI-CAN-22290 family). ZDI coordinated disclosure typically keeps technical details embargoed. No exploit code on GitHub, ExploitDB, or Metasploit.
EPSS Score	0.01383 (1.38%) — bottom quartile. The actuarial probability of exploitation in the next 30 days is negligible.
CISA KEV Status	Not listed. No federal mandate to patch under BOD 22-01.
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` — 9.8 CRITICAL. The AV:N is misleading; Canon's advisory clarifies same-network-segment requirement, which functionally narrows this to AV:A (Adjacent) in most deployments, dropping the base score to ~8.8.
Affected Versions	Firmware ≤ 03.07 across all regional variants: i-SENSYS MF754Cdw/MF752Cdw/LBP673Cdw/C1333i/C1333iF/C1333P (EU), Color imageCLASS MF753Cdw/MF751Cdw/MF1333C/LBP674Cdw/LBP1333C (NA), Satera MF750C/LBP670C (JP).
Fixed Versions	Canon firmware updates released February 2024 via Canon PSIRT CP2024-001. Exact version number not published in advisory; users must download the latest firmware from regional Canon support portals.
Scanning / Exposure	No specific Shodan/Censys/GreyNoise data for CVE-2024-0244. General printer exposure research shows thousands of printers internet-exposed globally, but Canon small-office MFPs represent a small fraction. Most enterprise deployments are internal-only.
Disclosure Date	2024-02-06 — part of a coordinated batch of 7 critical Canon printer CVEs (CVE-2023-6229 through CVE-2023-6234 plus CVE-2024-0244).
Reporting Researcher	Connor Ford (`@ByteInsight`), Nettitude, via Trend Micro Zero Day Initiative (ZDI).

Sources.

05 · The Call

Final Verdict

↓ DOWNGRADED to MEDIUM (5.5/10)

Why this verdict

Network-segment friction negates AV:N scoring: Canon's own advisory states the attacker must be on the *same network segment* or the printer must be directly internet-exposed. In enterprise environments, this means the attacker already has internal network access — a post-initial-access position. The CVSS vector should functionally be AV:A (Adjacent), which alone drops the base score from 9.8 to ~8.8. In practice, it means this vuln is only exploitable by someone who already has a foothold.
No PoC, no ITW exploitation, negligible EPSS: There is zero public exploit code, no known weaponization, no in-the-wild campaigns, and EPSS is 1.38%. The threat is entirely theoretical as of September 2026 — over 2.5 years post-disclosure.
Target is a peripheral appliance, not infrastructure: The affected devices are small-office multifunction printers. Compromising one yields control of an embedded ARM RTOS — not a Windows/Linux server, not a domain controller, not a hypervisor. Post-exploitation utility is severely limited by the constrained embedded environment.
Role multiplier: (a) *Low-value role* — home/SOHO printer, the majority of the installed base: chain succeeds trivially but blast radius is a single device with near-zero enterprise impact. (b) *Typical role* — department printer in an enterprise: chain requires prior internal access; blast radius is host-level with potential document interception (PII/financial/legal docs in print queue). (c) *High-value role* — printers are NOT in the high-value-role catalog. They are not identity infrastructure, hypervisors, CI/CD, PAM, PKI, backup, kernel agents, network edge, SIEM, or OT controllers. The worst plausible outcome is a network foothold + document intercept, which is host-level, not domain/fleet/supply-chain scale. No floor override applies.
Compounding friction summary: Requires internal network access (post-initial-access) + proprietary protocol knowledge (no public docs) + no exploit tooling available + target is a low-value embedded appliance = each prerequisite compounds downward pressure. The 9.8 vendor score is reduced by ~4.3 points to 5.5.

Why not higher?

The vuln does enable unauthenticated RCE with no user interaction once you're on-segment, and printers are often unmonitored blind spots with no EDR coverage — a compromised printer is a stealthy persistence point. Document interception in sensitive departments (legal, executive, HR) could yield high-value data. These factors prevent dropping below MEDIUM.

Why not lower?

Despite the heavy friction, the core primitive — unauthenticated RCE on a network device with no security monitoring — has real value to an attacker who already has internal access. Printers are rarely patched, meaning this vuln will persist in environments for years. The embedded foothold is invisible to EDR and SIEM in most deployments. These factors keep it above LOW.

06 · Verification

Crowdsourced verification payload.

Run this script from any host on the same network as the target printer. Invoke with python3 check_canon_cve_2024_0244.py <printer_ip>. No special privileges required — it connects to the printer's HTTP management interface to read the firmware version. Requires the requests library (pip install requests).

noisgate-verify.py

PYTHONREAD-ONLYSAFE

#!/usr/bin/env python3
"""Check Canon MFP firmware for CVE-2024-0244 vulnerability.
Usage: python3 check_canon_cve_2024_0244.py <printer_ip>
Output: VULNERABLE / PATCHED / UNKNOWN
"""
import sys
import re
import requests

AFFECTED_MODELS = [
    "MF754", "MF753", "MF752", "MF751", "MF756",
    "LBP673", "LBP674", "LBP1333",
    "MF1333", "C1333",
    "MF750", "LBP670"
]
FIXED_FW = (3, 8)  # Versions > 03.07 are patched

def check_printer(ip):
    url = f"http://{ip}/airprint.html"
    alt_url = f"http://{ip}/"
    content = ""
    for u in [url, alt_url]:
        try:
            r = requests.get(u, timeout=10, verify=False)
            if r.status_code == 200:
                content += r.text
        except Exception:
            pass

    if not content:
        print(f"UNKNOWN - Could not connect to {ip}")
        sys.exit(2)

    # Check if it's an affected Canon model
    model_match = None
    for model in AFFECTED_MODELS:
        if model.lower() in content.lower():
            model_match = model
            break

    if not model_match:
        print(f"UNKNOWN - Device at {ip} does not appear to be an affected Canon model")
        sys.exit(2)

    # Extract firmware version
    fw_patterns = [
        r'[Ff]irmware[\s:]*[Vv]?(\d+)\.(\d+)',
        r'[Vv]ersion[\s:]*[Vv]?(\d+)\.(\d+)',
        r'FW[\s:]*[Vv]?(\d+)\.(\d+)',
    ]
    for pat in fw_patterns:
        m = re.search(pat, content)
        if m:
            major, minor = int(m.group(1)), int(m.group(2))
            if (major, minor) <= (3, 7):
                print(f"VULNERABLE - {model_match} firmware {major:02d}.{minor:02d} <= 03.07 (CVE-2024-0244)")
                sys.exit(1)
            else:
                print(f"PATCHED - {model_match} firmware {major:02d}.{minor:02d} > 03.07")
                sys.exit(0)

    print(f"UNKNOWN - Found model {model_match} at {ip} but could not determine firmware version")
    sys.exit(2)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 check_canon_cve_2024_0244.py <printer_ip>")
        sys.exit(2)
    requests.packages.urllib3.disable_warnings()
    check_printer(sys.argv[1])