Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers

CVE-2024-0244 is a stack-based buffer overflow in the CPCA (Canon Proprietary Control Architecture) PCFAX number processing code running on Canon small-office multifunction printers and laser printers. The affected firmware is version 03.07 and earlier across regional model families: i-SENSYS MF754Cdw / MF752Cdw / LBP673Cdw / C1333i / C1333iF / C1333P (Europe), Color imageCLASS MF753Cdw / MF751Cdw / MF1333C / LBP674Cdw / LBP1333C (North America), and Satera MF750C / LBP670C (Japan). An unauthenticated attacker who can reach the printer's network interface can send a crafted CPCA packet to overflow the buffer, potentially achieving arbitrary code execution on the printer's embedded ARM processor or causing a denial-of-service condition. The flaw was reported by Connor Ford (@ByteInsight) of Nettitude through Trend Micro's Zero Day Initiative.

Canon's CVSS 9.8 CRITICAL rating is technically defensible on paper — the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H implies trivial remote exploitation — but it ignores three compounding realities. First, Canon's own advisory clarifies the attacker must be *on the same network segment* or the printer must have a public IP without a router; in enterprise environments this means the attacker is already post-initial-access. Second, the target is a small-office printer appliance, not a server, domain controller, or security-critical infrastructure — full compromise yields control of an embedded device, not a Windows domain. Third, there is no public proof-of-concept, no known in-the-wild exploitation, and EPSS sits at 1.38% — the actuarial odds of exploitation are negligible. The 9.8 is vendor CYA scoring, not operational reality.

1. Isolate printers on a dedicated VLAN with strict ACLs — Place all Canon MFPs on a print-only VLAN that permits traffic only from print servers and management stations. Block all outbound internet from the printer VLAN. This eliminates both the internet-exposure vector and limits lateral movement from a compromised printer. No noisgate mitigation SLA applies for MEDIUM — go straight to the 365-day remediation window.
2. Disable unused network protocols including CPCA fax services — If PCFAX functionality is not in use, disable it in the printer's web management interface under Network Settings. This removes the vulnerable code path entirely. Consult Canon documentation for your specific model variant.
3. Apply Canon firmware updates within the 365-day remediation window — Download and apply the latest firmware from your regional Canon support portal. Canon released patches in February 2024 via advisory CP2024-001. Firmware updates on printers typically require manual intervention per device or deployment via Canon's fleet management tools.
4. Monitor printer network traffic with NDR/NTA — Configure your network detection and response platform to alert on anomalous outbound connections from printer IP addresses — especially connections to external IPs, DNS queries for non-printing domains, or unusual protocol usage. This compensates for the lack of endpoint detection on embedded devices.
5. Restrict printer web management interface access — Limit access to the printer's HTTP/HTTPS management interface to authorized administrator IP addresses only. This prevents attackers from using the management interface for reconnaissance even if they reach the printer's network segment.

Run this script from any host on the same network as the target printer. Invoke with python3 check_canon_cve_2024_0244.py <printer_ip>. No special privileges required — it connects to the printer's HTTP management interface to read the firmware version. Requires the requests library (pip install requests).

#!/usr/bin/env python3
"""Check Canon MFP firmware for CVE-2024-0244 vulnerability.
Usage: python3 check_canon_cve_2024_0244.py <printer_ip>
Output: VULNERABLE / PATCHED / UNKNOWN
"""
import sys
import re
import requests

AFFECTED_MODELS = [
    "MF754", "MF753", "MF752", "MF751", "MF756",
    "LBP673", "LBP674", "LBP1333",
    "MF1333", "C1333",
    "MF750", "LBP670"
]
FIXED_FW = (3, 8)  # Versions > 03.07 are patched

def check_printer(ip):
    url = f"http://{ip}/airprint.html"
    alt_url = f"http://{ip}/"
    content = ""
    for u in [url, alt_url]:
        try:
            r = requests.get(u, timeout=10, verify=False)
            if r.status_code == 200:
                content += r.text
        except Exception:
            pass

    if not content:
        print(f"UNKNOWN - Could not connect to {ip}")
        sys.exit(2)

    # Check if it's an affected Canon model
    model_match = None
    for model in AFFECTED_MODELS:
        if model.lower() in content.lower():
            model_match = model
            break

    if not model_match:
        print(f"UNKNOWN - Device at {ip} does not appear to be an affected Canon model")
        sys.exit(2)

    # Extract firmware version
    fw_patterns = [
        r'[Ff]irmware[\s:]*[Vv]?(\d+)\.(\d+)',
        r'[Vv]ersion[\s:]*[Vv]?(\d+)\.(\d+)',
        r'FW[\s:]*[Vv]?(\d+)\.(\d+)',
    ]
    for pat in fw_patterns:
        m = re.search(pat, content)
        if m:
            major, minor = int(m.group(1)), int(m.group(2))
            if (major, minor) <= (3, 7):
                print(f"VULNERABLE - {model_match} firmware {major:02d}.{minor:02d} <= 03.07 (CVE-2024-0244)")
                sys.exit(1)
            else:
                print(f"PATCHED - {model_match} firmware {major:02d}.{minor:02d} > 03.07")
                sys.exit(0)

    print(f"UNKNOWN - Found model {model_match} at {ip} but could not determine firmware version")
    sys.exit(2)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 check_canon_cve_2024_0244.py <printer_ip>")
        sys.exit(2)
    requests.packages.urllib3.disable_warnings()
    check_printer(sys.argv[1])

1. SecurityWeek — Canon Patches 7 Critical Vulnerabilities in Small Office Printers
2. Canon U.S.A. — Service Notice: Buffer Overflow for Laser Printers and Small Office MFPs
3. Canon PSIRT Advisory CP2024-001
4. Canon Europe — Product Security Latest News
5. Shodan CVEDB — CVE-2024-0244 Dashboard
6. CyberStrike — CVE-2024-0244 Detail
7. Keypoint Intelligence — Canon and Xerox Printer Vulnerabilities