Canon
25 CVEs across 612 Canon products. Browse Canon vulnerabilities, severities, and proof-of-concept exploits.
Canon products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9262 | Medium | 6.5 | 2026-06-16 | Use of a non-secure protocol as the default FTP configuration in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9261 | Medium | 6.8 | 2026-06-16 | Use of weak SSH cryptographic algorithms in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9260 | Medium | 6.2 | 2026-06-16 | Use of hard-coded cryptographic keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9259 | Medium | 6.5 | 2026-06-16 | Improper validation of server certificates in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2026-9258 | Medium | 6.5 | 2026-06-16 | Improper validation of SSH host keys in Canon EOS Network Setting Tool Version 1.5.0 or earlier |
CVE-2025-14237 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2025-14236 | Critical | 9.8 | 2026-01-16 | Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigge… |
CVE-2025-14235 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2025-14234 | Critical | 9.8 | 2026-01-16 | Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trig… |
CVE-2025-14233 | Critical | 9.8 | 2026-01-16 | Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment t… |
CVE-2025-14232 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment t… |
CVE-2025-14231 | Critical | 9.8 | 2026-01-16 | Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment… |
CVE-2025-2146 | Critical | 9.8 | 2025-05-26 | Buffer overflow in WebService Authentication processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network… |
CVE-2024-12649 | Critical | 9.8 | 2025-01-28 | Buffer overflow in XPS data font processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2024-12648 | Critical | 9.8 | 2025-01-28 | Buffer overflow in TIFF data EXIF tag processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-12647 | Critical | 9.8 | 2025-01-28 | Buffer overflow in CPCA font download processing of Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2024-0244 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigg… |
CVE-2023-6234 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network s… |
CVE-2023-6233 | Critical | 9.8 | 2024-02-06 | Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to t… |
CVE-2023-6232 | Critical | 9.8 | 2024-02-06 | Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which m… |
CVE-2023-6231 | Critical | 9.8 | 2024-02-06 | Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigg… |
CVE-2023-6230 | Critical | 9.8 | 2024-02-06 | Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Printers(*) which m… |
CVE-2023-6229 | Critical | 9.8 | 2024-02-06 | Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment… |
CVE-2023-1764 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-1763 | Medium | 6.5 | 2023-05-17 | Canon IJ Network Tool/Ver.4.7.5 and earlier (supported OS: OS X 10.9.5-macOS 13),IJ Network Tool/Ver.4.7.3 and earlier (supported OS: OS X 10.7.5-OS X 10.8) al… |
CVE-2023-0859 | Low | 2.2 | 2023-05-11 | Arbitrary Files can be installed in the Setting Data Import function of Office / Small Office Multifunction Printers and Laser Printers(*). *:Satera LBP660C Se… |
CVE-2023-0858 | Low | 3.1 | 2023-05-11 | Improper Authentication of RemoteUI of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2023-0857 | Medium | 5.9 | 2023-05-11 | Unintentional change of settings during initial registration of system administrators which uses control protocols. The affected Office / Small Office Multifun… |
CVE-2023-0856 | Critical | 9.8 | 2023-05-11 | Buffer overflow in IPP sides attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network… |
CVE-2023-0855 | Critical | 9.8 | 2023-05-11 | Buffer overflow in IPP number-up attribute process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the net… |
CVE-2023-0854 | Critical | 9.8 | 2023-05-11 | Buffer overflow in NetBIOS QNAME registering and communication process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an… |
CVE-2023-0853 | Critical | 9.8 | 2023-05-11 | Buffer overflow in mDNS NSEC record registering process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on th… |
CVE-2023-0852 | Critical | 9.8 | 2023-05-11 | Buffer overflow in the Address Book of Mobile Device function of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker… |
CVE-2023-0851 | Critical | 9.8 | 2023-05-11 | Buffer overflow in CPCA Resource Download process of Office / Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netw… |
CVE-2022-43608 | High | 8.8 | 2023-03-29 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.03 printers. Authentic… |
CVE-2022-24674 | High | 8.8 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentic… |
CVE-2022-24673 | Critical | 9.8 | 2023-03-28 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentication is n… |
CVE-2022-24672 | High | 8.8 | 2023-03-28 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentic… |
CVE-2022-38765 | Medium | 6.5 | 2022-12-09 | Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imag… |
CVE-2022-37461 | Medium | 6.1 | 2022-09-30 | Multiple cross-site scripting (XSS) vulnerabilities in Canon Medical Vitrea View 7.x before 7.7.6 allow remote attackers to inject arbitrary web script or HTML… |
CVE-2022-26111 | High | 8.8 | 2022-04-25 | The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an exist… |
CVE-2022-26320 | Critical | 9.1 | 2022-03-14 | The Rambus SafeZone Basic Crypto Module before 10.4.0, as used in certain Fujifilm (formerly Fuji Xerox) devices before 2022-03-01, Canon imagePROGRAF and imag… |
CVE-2021-20877 | Medium | 4.8 | 2022-02-08 | Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers (LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw… |
CVE-2021-43471 | High | 7.5 | 2021-12-06 | In Canon LBP223 printers, the System Manager Mode login does not require an account password or PIN. An attacker can remotely shut down the device after enteri… |
CVE-2021-38154 | High | 7.5 | 2021-08-29 | Certain Canon devices manufactured in 2012 through 2020 (such as imageRUNNER ADVANCE iR-ADV C5250), when Catwalk Server is enabled for HTTP access, allow remot… |
CVE-2021-39368 | Medium | 6.1 | 2021-08-23 | Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter. |
CVE-2021-39367 | Medium | 5.3 | 2021-08-23 | Canon Oce Print Exec Workgroup 1.3.2 allows Host header injection. |
CVE-2021-38085 | High | 7.8 | 2021-08-11 | The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CN… |
CVE-2020-16849 | High | 7.5 | 2020-11-30 | An issue was discovered on Canon MF237w 06.07 devices. An "Improper Handling of Length Parameter Inconsistency" issue in the IPv4/ICMPv4 component, when handli… |
CVE-2020-26508 | Critical | 9.8 | 2020-11-16 | The WebTools component on Canon Oce ColorWave 3500 5.1.1.0 devices allows attackers to retrieve stored SMB credentials via the export feature, even though thes… |
CVE-2020-12695 | High | 7.5 | 2020-06-08 | The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a differe… |
CVE-2020-10669 | High | 7.5 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to authentication bypass on the page /home.jsp. An unauthenticated att… |
CVE-2020-10671 | High | 8.8 | 2020-03-19 | The Canon Oce Colorwave 500 4.0.0.0 printer's web application is missing any form of CSRF protections. This is a system-wide issue. An attacker could perform a… |
CVE-2020-10670 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogConten… |
CVE-2020-10668 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOT… |
CVE-2020-10667 | Medium | 6.1 | 2020-03-19 | The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Stored XSS in /TemplateManager/indexExternalLocation.jsp. The vulne… |
CVE-2019-14339 | Medium | 5.5 | 2019-09-05 | The ContentProvider in the Canon PRINT jp.co.canon.bsd.ad.pixmaprint 2.5.5 application for Android does not properly restrict canon.ij.printer.capability.data… |
CVE-2019-6001 | Medium | 6.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-6000 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5999 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5998 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2019-5995 | Medium | 6.5 | 2019-08-06 | Missing authorization vulnerability exists in EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1.1.6 and… |
CVE-2019-5994 | High | 8.8 | 2019-08-06 | Buffer overflow in PTP (Picture Transfer Protocol) of EOS series digital cameras (EOS-1D X firmware version 2.1.0 and earlier, EOS-1D X MKII firmware version 1… |
CVE-2018-12111 | Medium | 6.1 | 2018-06-11 | Cross-site scripting (XSS) vulnerability in the Canon PrintMe EFI webinterface allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO… |
CVE-2018-12049 | Critical | 9.8 | 2018-06-08 | A remote attacker can bypass the System Manager Mode on the Canon LBP6030w web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.ht… |
CVE-2018-12048 | Critical | 9.8 | 2018-06-08 | A remote attacker can bypass the Management Mode on the Canon LBP7110Cw web interface without a PIN for /checkLogin.cgi via vectors involving /portal_top.html… |
CVE-2018-11711 | Critical | 9.8 | 2018-06-04 | A remote attacker can bypass the System Manager Mode on the Canon MF210 and MF220 web interface without knowing the PIN for /login.html via vectors involving /… |
CVE-2018-11692 | Critical | 9.8 | 2018-06-04 | An issue was discovered on Canon LBP6650, LBP3370, LBP3460, and LBP7750C devices. It is possible to bypass the Administrator Mode authentication for /tlogin.cg… |
CVE-2015-5631 | | 2015-09-11 | Cross-site request forgery (CSRF) vulnerability in the Remote UI on Canon PIXMA MG7500 printers allows remote attackers to hijack the authentication of adminis… | |
CVE-2013-4615 | | 2013-06-21 | The Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers allow remote attackers to cause a denial of service (device hang) via a… | |
CVE-2013-4614 | | 2013-06-21 | English/pages_MacUS/wls_set_content.html on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers shows the Wi-Fi PSK passphr… | |
CVE-2013-4613 | | 2013-06-21 | The default configuration of the administrative interface on the Canon MG3100, MG5300, MG6100, MP495, MX340, MX870, MX890, MX920, and MX922 printers does not r… | |
CVE-2008-0303 | | 2008-02-29 | The FTP print feature in multiple Canon printers, including imageRUNNER and imagePRESS, allow remote attackers to use the server as an inadvertent proxy via a… | |
CVE-2007-2680 | | 2007-05-15 | Cross-site scripting (XSS) vulnerability in the management interface in Canon Network Camera Server VB100 and VB101 with firmware 3.0 R69 and earlier, and VB15… | |
CVE-2006-7065 | | 2007-03-02 | Microsoft Internet Explorer allows remote attackers to cause a denial of service (crash) via an IFRAME with a certain XML file and XSL stylesheet that triggers… | |
CVE-2006-4680 | | 2006-09-11 | The Remote UI in Canon imageRUNNER includes usernames and passwords when exporting an address book, which allows context-dependent attackers to obtain sensitiv… | |
CVE-2006-3354 | | 2006-07-06 | Microsoft Internet Explorer 6 allows remote attackers to cause a denial of service (crash) by setting the Filter property of an ADODB.Recordset ActiveX object… | |
CVE-2006-2900 | | 2006-06-07 | Internet Explorer 6 allows user-assisted remote attackers to read arbitrary files by tricking a user into typing the characters of the target filename in a tex… | |
CVE-2006-1192 | | 2006-04-11 | Microsoft Internet Explorer 5.01 through 6 allows remote attackers to conduct phishing attacks by spoofing the address bar and other parts of the trust UI via… | |
CVE-2006-1188 | | 2006-04-11 | Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via HTML elements with a certain crafted tag, which leads to memor… | |
CVE-2006-1185 | | 2006-04-11 | Unspecified vulnerability in Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary code via certain invalid HTML that causes… | |
CVE-2005-4827 | | 2005-12-31 | Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended… | |
CVE-2004-2166 | | 2004-12-31 | The print-from-email feature in the Canon ImageRUNNER (iR) 5000i and C3200 digital printer, when not using IP address range filtering, allows remote attackers… |